General
-
Target
JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a
-
Size
127KB
-
Sample
250129-a7f44ayngj
-
MD5
50fdb69b11956e5ed93d58db354b2f0a
-
SHA1
e5df6860acaf3beff599903a50b292ff18dfd352
-
SHA256
06d6ba6e3dbf1a2e226fa518b9ddda0da9548a7b60e5bf303e0e9a5f6eae4023
-
SHA512
f62632a7313c137d5aef5ee322658267ddd978f6a2aa1dd91001211a38a461679164dbf5f829a612311eee242cdbf58e7a4b91ddb6186ec912756bde936576a1
-
SSDEEP
1536:s+5DMoxyY+PG35SbdnS4SKEFhAi0sIz5I7+q7SIqlysxPg7DeS/6q4XOYqxn0k6:KoxhYbdnpSpasIzHqpqqr4Xhqxn0k6
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a.exe
Resource
win10v2004-20250129-en
Malware Config
Extracted
pony
http://108.166.65.182:8080/pony/gate.php
http://aloucakbileti.com:8080/pony/gate.php
-
payload_url
http://aceite.elovantagens.com.br/os1Giry.exe
http://talentquest.com.mx/1MPj.exe
http://zirmatech.com.br/9exoNyD3.exe
http://apostagol1.web102.f1.k8.com.br/782V.exe
Targets
-
-
Target
JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a
-
Size
127KB
-
MD5
50fdb69b11956e5ed93d58db354b2f0a
-
SHA1
e5df6860acaf3beff599903a50b292ff18dfd352
-
SHA256
06d6ba6e3dbf1a2e226fa518b9ddda0da9548a7b60e5bf303e0e9a5f6eae4023
-
SHA512
f62632a7313c137d5aef5ee322658267ddd978f6a2aa1dd91001211a38a461679164dbf5f829a612311eee242cdbf58e7a4b91ddb6186ec912756bde936576a1
-
SSDEEP
1536:s+5DMoxyY+PG35SbdnS4SKEFhAi0sIz5I7+q7SIqlysxPg7DeS/6q4XOYqxn0k6:KoxhYbdnpSpasIzHqpqqr4Xhqxn0k6
-
Pony family
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-