General
-
Target
29ae7008237b4b22db2faa66bce29f0e_JaffaCakes118
-
Size
115KB
-
Sample
240707-c7st1a1hmq
-
MD5
29ae7008237b4b22db2faa66bce29f0e
-
SHA1
e0099af9d2ca2cea747ebe81aed405c57bae309d
-
SHA256
6ae4791193a422e375fbd07ec8f7f3c842e0e43862a2b7a73d57291940914722
-
SHA512
da60fecd8f913a915916f8f7fa56ef3ab40212a9e54b0156b43154880958576a5434b236d19329e5fbcc26f847f1cc25aa01aa2ab142aed0d12c3966317de94f
-
SSDEEP
3072:aYSA1PKVvxyy5InBnZXhfiCA313Ct4edROHyiR9:LnkrEZXhfNJhWR
Static task
static1
Behavioral task
behavioral1
Sample
29ae7008237b4b22db2faa66bce29f0e_JaffaCakes118.exe
Resource
win7-20240705-en
Malware Config
Extracted
pony
http://212.58.20.11/forum/viewtopic.php
http://108.178.59.38/forum/viewtopic.php
-
payload_url
http://myvidawell.h1864257.stratoserver.net/5Gy.exe
http://www.luxurytimedistribution.com/QGp2J.exe
http://absolute-clan.net/QFX3Q.exe
http://ftp.xflagfootball.com/WU00L.exe
http://demotypo.conceptnet.de/LXapSM.exe
Targets
-
-
Target
29ae7008237b4b22db2faa66bce29f0e_JaffaCakes118
-
Size
115KB
-
MD5
29ae7008237b4b22db2faa66bce29f0e
-
SHA1
e0099af9d2ca2cea747ebe81aed405c57bae309d
-
SHA256
6ae4791193a422e375fbd07ec8f7f3c842e0e43862a2b7a73d57291940914722
-
SHA512
da60fecd8f913a915916f8f7fa56ef3ab40212a9e54b0156b43154880958576a5434b236d19329e5fbcc26f847f1cc25aa01aa2ab142aed0d12c3966317de94f
-
SSDEEP
3072:aYSA1PKVvxyy5InBnZXhfiCA313Ct4edROHyiR9:LnkrEZXhfNJhWR
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-