General

  • Target

    JaffaCakes118_4a9555f8229c22a83b9ce1126634828e

  • Size

    74KB

  • Sample

    250128-n214zaxpdw

  • MD5

    4a9555f8229c22a83b9ce1126634828e

  • SHA1

    9702f4d3af8efaa182dc22092d433a9d690666d6

  • SHA256

    e31cca0fb4a94ba4a031b4665fc7b7be42cf9e9868f113bd43039b5c41da4b78

  • SHA512

    98011ff602d615e2bae1aaaeefa4bd8b74ebf5f7c20f69378b72b42adcff47d883f3a9326103b06254dc08a52a6fd76c4661632489383f30ab7a55b639e042c8

  • SSDEEP

    1536:557ChIEVdlxqXbxfqB7ZJe7CXrVTV42DVdTgURIA4+/s3Z/QlhhD/Qi:aXZdn7FV4WVdjRVHs3YQi

Malware Config

Targets

    • Target

      JaffaCakes118_4a9555f8229c22a83b9ce1126634828e

    • Size

      74KB

    • MD5

      4a9555f8229c22a83b9ce1126634828e

    • SHA1

      9702f4d3af8efaa182dc22092d433a9d690666d6

    • SHA256

      e31cca0fb4a94ba4a031b4665fc7b7be42cf9e9868f113bd43039b5c41da4b78

    • SHA512

      98011ff602d615e2bae1aaaeefa4bd8b74ebf5f7c20f69378b72b42adcff47d883f3a9326103b06254dc08a52a6fd76c4661632489383f30ab7a55b639e042c8

    • SSDEEP

      1536:557ChIEVdlxqXbxfqB7ZJe7CXrVTV42DVdTgURIA4+/s3Z/QlhhD/Qi:aXZdn7FV4WVdjRVHs3YQi

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks