Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d48010fcb825b63dd150a876392f3552_JaffaCakes118
-
Size
100KB
-
Sample
241208-belpjstmhv
-
MD5
d48010fcb825b63dd150a876392f3552
-
SHA1
67586a659d5a2dc2f9ddd278c4538bc27b2d1eed
-
SHA256
75d2fe6ed7499c84a137c71e22393277477f76d39e465bac2b7657f7c9c295cd
-
SHA512
cc13acb260cec9f29da26a44ea15bbcf4c78c71574946edcc0be8e5e121db2f101a3c61fd3523f9c55a54d0fe6a1e0b90c94747bc5176fe8c8a4578f97e79842
-
SSDEEP
1536:33Mu8xsb0BTyI6WZMPc6rnrRqaYy0JKniSl5tS7+CVQ8ZOd9TYAXPDlfAAA:3nNb0BTZbZKjrMXknblHI9m9TYAXP
Static task
static1
Behavioral task
behavioral1
Sample
d48010fcb825b63dd150a876392f3552_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d48010fcb825b63dd150a876392f3552_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://115.47.49.181/xSZ64Wiax/ojXVZBxRQVfp6gAUziCGnB8V7Aikbs0Z.php
Targets
-
-
Target
d48010fcb825b63dd150a876392f3552_JaffaCakes118
-
Size
100KB
-
MD5
d48010fcb825b63dd150a876392f3552
-
SHA1
67586a659d5a2dc2f9ddd278c4538bc27b2d1eed
-
SHA256
75d2fe6ed7499c84a137c71e22393277477f76d39e465bac2b7657f7c9c295cd
-
SHA512
cc13acb260cec9f29da26a44ea15bbcf4c78c71574946edcc0be8e5e121db2f101a3c61fd3523f9c55a54d0fe6a1e0b90c94747bc5176fe8c8a4578f97e79842
-
SSDEEP
1536:33Mu8xsb0BTyI6WZMPc6rnrRqaYy0JKniSl5tS7+CVQ8ZOd9TYAXPDlfAAA:3nNb0BTZbZKjrMXknblHI9m9TYAXP
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-