General
-
Target
1c5b9535d7f30faf5c7cf038946b99b9_JaffaCakes118
-
Size
168KB
-
Sample
240701-y29q8axdkc
-
MD5
1c5b9535d7f30faf5c7cf038946b99b9
-
SHA1
4398fbbdce9605f74c06be649bac3d20bb239e99
-
SHA256
2a901298895c8f5d9b7617448e0fa890931f82879e181ae102f7532738d5ca84
-
SHA512
3ee9b882d96e230afdc9b9e7da0ad360d6a51bfe66be86700afe2857ab3e9361065305d4a1ebe4bc4d1e574a4f87f6111771e33e966f69581f8d41a5aae66d3e
-
SSDEEP
3072:Cp5qYw6ZJWdcNS/LzEziHRhqEbLcV9Mmlx8EH2wqQQ:COYx/WUOL4ziHyEbLm2mlx8EWOQ
Static task
static1
Behavioral task
behavioral1
Sample
1c5b9535d7f30faf5c7cf038946b99b9_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
pony
http://momus.com.tw:8080/pony/gate.php
http://66.175.220.58/pony/gate.php
-
payload_url
http://zupti.com.br/301MHWrw.exe
http://magentoexpertdeveloper.com/LCyUu.exe
http://ftp.videoheretic.com/vFs6cZZ.exe
Targets
-
-
Target
1c5b9535d7f30faf5c7cf038946b99b9_JaffaCakes118
-
Size
168KB
-
MD5
1c5b9535d7f30faf5c7cf038946b99b9
-
SHA1
4398fbbdce9605f74c06be649bac3d20bb239e99
-
SHA256
2a901298895c8f5d9b7617448e0fa890931f82879e181ae102f7532738d5ca84
-
SHA512
3ee9b882d96e230afdc9b9e7da0ad360d6a51bfe66be86700afe2857ab3e9361065305d4a1ebe4bc4d1e574a4f87f6111771e33e966f69581f8d41a5aae66d3e
-
SSDEEP
3072:Cp5qYw6ZJWdcNS/LzEziHRhqEbLcV9Mmlx8EH2wqQQ:COYx/WUOL4ziHyEbLm2mlx8EWOQ
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-