General

  • Target

    03433707d9a61e844fae1b3515cc72ce_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240427-psysxsbc2t

  • MD5

    03433707d9a61e844fae1b3515cc72ce

  • SHA1

    9cf0dd1ea09277bbd27ac4235930f7ec86b6e79a

  • SHA256

    de4fb705cb1c9ba998769951858af2f90a6aca9c5f5d352a0f649cfe99c39a96

  • SHA512

    687202510db705d0fb932b0ef733097f5311d20a5ead94d1edd90f106e011d7beb33a0c24461b5ffa51b1c180e87dd5c762764cae4b005af5cfa239121708a2a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZI:0UzeyQMS4DqodCnoe+iitjWww8

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      03433707d9a61e844fae1b3515cc72ce_JaffaCakes118

    • Size

      2.2MB

    • MD5

      03433707d9a61e844fae1b3515cc72ce

    • SHA1

      9cf0dd1ea09277bbd27ac4235930f7ec86b6e79a

    • SHA256

      de4fb705cb1c9ba998769951858af2f90a6aca9c5f5d352a0f649cfe99c39a96

    • SHA512

      687202510db705d0fb932b0ef733097f5311d20a5ead94d1edd90f106e011d7beb33a0c24461b5ffa51b1c180e87dd5c762764cae4b005af5cfa239121708a2a

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZI:0UzeyQMS4DqodCnoe+iitjWww8

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks