General
-
Target
8a7e6c7d49f867002fa4164eb81c708d_JaffaCakes118
-
Size
101KB
-
Sample
241103-j8hhzszbnh
-
MD5
8a7e6c7d49f867002fa4164eb81c708d
-
SHA1
9190927b98a3475910002fc9bf4f1ea3c044ddd3
-
SHA256
3d79067eebb706a0939b5cdbf2f207cb86ddf25f23406800f32da2d60c3bbf66
-
SHA512
92833f3e37db7c53f7fa61b6b54d4749cf27a6cf2e178675a98053e0dc18798e830aa9dd06352f726e622d6597c62ca62ff7a0a885f232b6a7bda2913180c3fe
-
SSDEEP
1536:s2jbDunUIWkepd4/hXCijlj2nQB5ofpigiq01UThLG:ssImp7e7B5ofpigiq01UT
Static task
static1
Behavioral task
behavioral1
Sample
8a7e6c7d49f867002fa4164eb81c708d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a7e6c7d49f867002fa4164eb81c708d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://115.47.49.181/xSZ64Wiax/ojXVZBxRQVfp6gAUziCGnB8V7Aikbs0Z.php
Targets
-
-
Target
8a7e6c7d49f867002fa4164eb81c708d_JaffaCakes118
-
Size
101KB
-
MD5
8a7e6c7d49f867002fa4164eb81c708d
-
SHA1
9190927b98a3475910002fc9bf4f1ea3c044ddd3
-
SHA256
3d79067eebb706a0939b5cdbf2f207cb86ddf25f23406800f32da2d60c3bbf66
-
SHA512
92833f3e37db7c53f7fa61b6b54d4749cf27a6cf2e178675a98053e0dc18798e830aa9dd06352f726e622d6597c62ca62ff7a0a885f232b6a7bda2913180c3fe
-
SSDEEP
1536:s2jbDunUIWkepd4/hXCijlj2nQB5ofpigiq01UThLG:ssImp7e7B5ofpigiq01UT
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-