General
-
Target
JaffaCakes118_0d2ec45681cbe05f936a9300defa6e58
-
Size
250KB
-
Sample
250112-m9rd3azlhx
-
MD5
0d2ec45681cbe05f936a9300defa6e58
-
SHA1
271bf51c129413d847f7135926ae6d770c1c272d
-
SHA256
cc96d86adc5700b3433b8ea7ee1bdbdc78daf6f8227816709b566584a0edd40f
-
SHA512
f5a733bdf6b025a2d2f59759056880437f68efe0b98137244695cb291ce0ceb11e83561789d55946e5451d75b41ea40866de450a3fdadd12227be02596a3f6e8
-
SSDEEP
6144:KIv9+Hi2IjYMo1CGbIv9+Hi2IjYMo1CGJU:KIvQC287o1CIIvQC287o1Cv
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0d2ec45681cbe05f936a9300defa6e58.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0d2ec45681cbe05f936a9300defa6e58.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://rabbitharky.com/forum/viewtopic.php
http://roboxanger.com/forum/viewtopic.php
-
payload_url
http://atualizacoes.issqn.net/6PrbAL.exe
http://vasesetflacons.fr/TpEM.exe
Targets
-
-
Target
JaffaCakes118_0d2ec45681cbe05f936a9300defa6e58
-
Size
250KB
-
MD5
0d2ec45681cbe05f936a9300defa6e58
-
SHA1
271bf51c129413d847f7135926ae6d770c1c272d
-
SHA256
cc96d86adc5700b3433b8ea7ee1bdbdc78daf6f8227816709b566584a0edd40f
-
SHA512
f5a733bdf6b025a2d2f59759056880437f68efe0b98137244695cb291ce0ceb11e83561789d55946e5451d75b41ea40866de450a3fdadd12227be02596a3f6e8
-
SSDEEP
6144:KIv9+Hi2IjYMo1CGbIv9+Hi2IjYMo1CGJU:KIvQC287o1CIIvQC287o1Cv
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-