General

  • Target

    0343bb24206206547c44aab7ca11b9f0_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240427-pts9tsbc4w

  • MD5

    0343bb24206206547c44aab7ca11b9f0

  • SHA1

    d4fcaf56009b03338c13933a1b4e630ff42fee61

  • SHA256

    94fff5c57fc33cc12b016a17d73190d8e4c5e6da6344854305b1933c702ad79f

  • SHA512

    942a066511023fac59acee6bb0b5839c27f9f06e1f9d4df36c0f3aab746a677eb890afdd2fad4b83cef9614310b118efb42806d911aace58734cb2dd2a003d64

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwt

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      0343bb24206206547c44aab7ca11b9f0_JaffaCakes118

    • Size

      2.2MB

    • MD5

      0343bb24206206547c44aab7ca11b9f0

    • SHA1

      d4fcaf56009b03338c13933a1b4e630ff42fee61

    • SHA256

      94fff5c57fc33cc12b016a17d73190d8e4c5e6da6344854305b1933c702ad79f

    • SHA512

      942a066511023fac59acee6bb0b5839c27f9f06e1f9d4df36c0f3aab746a677eb890afdd2fad4b83cef9614310b118efb42806d911aace58734cb2dd2a003d64

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwt

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks