General
-
Target
e7df43fbea294e019d7e8c05c2570154_JaffaCakes118
-
Size
100KB
-
Sample
241212-xx766awpbp
-
MD5
e7df43fbea294e019d7e8c05c2570154
-
SHA1
a52e2d228165ae56eefc0488bf7c7d2d1d5b95cb
-
SHA256
0a51248ff35661948545aacbe8c1266a7d053e3849f60ada412b0a14d512ff51
-
SHA512
ce3d7475aa3dcb802148e2569f8568bc296ab61d6025b07a20f4205a692b4da8e737b36236f6a2d4e368b3b286d6197a18e0e08e8383683ca34e0ae3c75a2b26
-
SSDEEP
3072:1TGRkoYDgkCXvke1JC4GkcDAWKuwDGPTD0LQHo:1TGWoY+fm5JO/GPTQ
Static task
static1
Behavioral task
behavioral1
Sample
e7df43fbea294e019d7e8c05c2570154_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e7df43fbea294e019d7e8c05c2570154_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://115.47.49.181/xSZ64Wiax/ojXVZBxRQVfp6gAUziCGnB8V7Aikbs0Z.php
Targets
-
-
Target
e7df43fbea294e019d7e8c05c2570154_JaffaCakes118
-
Size
100KB
-
MD5
e7df43fbea294e019d7e8c05c2570154
-
SHA1
a52e2d228165ae56eefc0488bf7c7d2d1d5b95cb
-
SHA256
0a51248ff35661948545aacbe8c1266a7d053e3849f60ada412b0a14d512ff51
-
SHA512
ce3d7475aa3dcb802148e2569f8568bc296ab61d6025b07a20f4205a692b4da8e737b36236f6a2d4e368b3b286d6197a18e0e08e8383683ca34e0ae3c75a2b26
-
SSDEEP
3072:1TGRkoYDgkCXvke1JC4GkcDAWKuwDGPTD0LQHo:1TGWoY+fm5JO/GPTQ
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-