General
-
Target
1b851438ec415474fed7ee8cfce3eb6d_JaffaCakes118
-
Size
151KB
-
Sample
240701-q1rv1svcnd
-
MD5
1b851438ec415474fed7ee8cfce3eb6d
-
SHA1
b28baf4af70ac5a44d2728f79291adb12c4f87e8
-
SHA256
d0fbdc95672aa6d8b16b4c37ad29d338d5d70a83de6cfbd906cf5f09737de25c
-
SHA512
c83d539d44f967251c41fd890f35ef2f1c9bbbfe816fd4af37037331537b7a0589aad0eee9519176b4b34438f632fcd2cde6224d0daf9efa95f0dd0500988fc5
-
SSDEEP
3072:pK7pS4GXhfwuq9O8y+FG53ZDw+EGzDS/1GTaDZT8WWxDgc2UVbAnA9LcanJL0G6L:EttcWb6ZKbBnMq
Static task
static1
Behavioral task
behavioral1
Sample
1b851438ec415474fed7ee8cfce3eb6d_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://67.215.225.205:8080/ponys/gate.php
http://216.231.139.111/ponys/gate.php
-
payload_url
http://123-engagement-ring.com/F2ziEErm.exe
http://sultanesmonterrey.com/6VRjCFx.exe
http://cafedoc.info/BxvUvh.exe
http://butelii-oxigen.ro/fojJM.exe
http://aurangabadproperties.com/rfoMUzmK.exe
Targets
-
-
Target
1b851438ec415474fed7ee8cfce3eb6d_JaffaCakes118
-
Size
151KB
-
MD5
1b851438ec415474fed7ee8cfce3eb6d
-
SHA1
b28baf4af70ac5a44d2728f79291adb12c4f87e8
-
SHA256
d0fbdc95672aa6d8b16b4c37ad29d338d5d70a83de6cfbd906cf5f09737de25c
-
SHA512
c83d539d44f967251c41fd890f35ef2f1c9bbbfe816fd4af37037331537b7a0589aad0eee9519176b4b34438f632fcd2cde6224d0daf9efa95f0dd0500988fc5
-
SSDEEP
3072:pK7pS4GXhfwuq9O8y+FG53ZDw+EGzDS/1GTaDZT8WWxDgc2UVbAnA9LcanJL0G6L:EttcWb6ZKbBnMq
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-