General
-
Target
JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b
-
Size
152KB
-
Sample
250119-xj62ya1qbr
-
MD5
d01f22d4d79a701c6e5f60495b5f264b
-
SHA1
d62b0fb0af3c36d99f38bcac2bb95448da897ebc
-
SHA256
37bb3ae756d865dcba75011ac2507d8f75da6655c0959a8bb8320b30ef6a52bc
-
SHA512
7757037c4e62f6422636e77a1bd14c71f1482c8e517bdda95202fa669dc97016ca8203c242084d1b35e137518e92595abb4bef6785579ad67c452f9f35b2eab4
-
SSDEEP
3072:ZRZgpCnOMTufH2YqelEWBnSz2tFfLVRDNKycG7/AFhtXC7XO6:ZRypCnOkOlEzzid/cQ4btSjO6
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://goatoncycle.com/forum/viewtopic.php
http://goatongoat.com/forum/viewtopic.php
-
payload_url
http://3073.a.hostable.me/Z2U.exe
http://85.18.21.252/PNV3Hbi.exe
Targets
-
-
Target
JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b
-
Size
152KB
-
MD5
d01f22d4d79a701c6e5f60495b5f264b
-
SHA1
d62b0fb0af3c36d99f38bcac2bb95448da897ebc
-
SHA256
37bb3ae756d865dcba75011ac2507d8f75da6655c0959a8bb8320b30ef6a52bc
-
SHA512
7757037c4e62f6422636e77a1bd14c71f1482c8e517bdda95202fa669dc97016ca8203c242084d1b35e137518e92595abb4bef6785579ad67c452f9f35b2eab4
-
SSDEEP
3072:ZRZgpCnOMTufH2YqelEWBnSz2tFfLVRDNKycG7/AFhtXC7XO6:ZRypCnOkOlEzzid/cQ4btSjO6
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-