General
-
Target
8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118
-
Size
188KB
-
Sample
241104-fq9b7stlez
-
MD5
8f4ca7f02d146d6b76a5e7682f952492
-
SHA1
0fa9a0484fe5cd2d294bec18ac2f97e7d08a3d85
-
SHA256
2e18254948c11fd4e111bdb483459d630ea4f0234615b0b4c65db3a68b312690
-
SHA512
d1f2d8346de708c3fc0fa23e4f493c02be6b6b7b456326280d975c90528084cf69dc9c77fd842871576634ad52abdc5147c9018bb46720188b423b96ba9f8262
-
SSDEEP
3072:dM1Yv6deFRNfMZU3t+PW1+1W3v1QRbjTp8OVioCm:dMZUMq3D1+1Qvm9xVt
Static task
static1
Behavioral task
behavioral1
Sample
8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://13.carnovirious.net/ponyb/gate.php
http://13.JONEMNOMINIK.NET/ponyb/gate.php
http://13.LOMERDASTER.NET/ponyb/gate.php
http://13.ZABAKARVESTER.NET/ponyb/gate.php
-
payload_url
http://www.ptci-md.org/gbQ2o1H.exe
http://www.abn-capital.com/PfH.exe
http://cancunie.com/v2km.exe
Targets
-
-
Target
8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118
-
Size
188KB
-
MD5
8f4ca7f02d146d6b76a5e7682f952492
-
SHA1
0fa9a0484fe5cd2d294bec18ac2f97e7d08a3d85
-
SHA256
2e18254948c11fd4e111bdb483459d630ea4f0234615b0b4c65db3a68b312690
-
SHA512
d1f2d8346de708c3fc0fa23e4f493c02be6b6b7b456326280d975c90528084cf69dc9c77fd842871576634ad52abdc5147c9018bb46720188b423b96ba9f8262
-
SSDEEP
3072:dM1Yv6deFRNfMZU3t+PW1+1W3v1QRbjTp8OVioCm:dMZUMq3D1+1Qvm9xVt
-
Pony family
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-