Overview

overview

10

Static

static

3

11a5bb69b6...18.dll

windows7-x64

10

11a5bb69b6...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    11a5bb69b695c1ae108e81502675d364_JaffaCakes118

  • Size

    68KB

  • Sample

    240504-h47rmsaa42

  • MD5

    11a5bb69b695c1ae108e81502675d364

  • SHA1

    384e2d1c71ea8713cbf5a17bd5342b4445d525d1

  • SHA256

    efc571defd30c72dee512c1470b43cc4a537c00ed8233e172380dcb66d10e48d

  • SHA512

    3834ee2645014e5f8fd37cf16fc06559c914de4de3a423945eaa9ed92593d3d35374004e897bbf2ac977d3a1e6befa1bffe748c28b04984c09dbf9a4cfe7bab2

  • SSDEEP

    1536:bjJbKQOqTjCEvR9VwO5ZbuOqxvv/kzLA/aZd/:/hjV9VwSZKOq9/aZ

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Targets

    • Target

      11a5bb69b695c1ae108e81502675d364_JaffaCakes118

    • Size

      68KB

    • MD5

      11a5bb69b695c1ae108e81502675d364

    • SHA1

      384e2d1c71ea8713cbf5a17bd5342b4445d525d1

    • SHA256

      efc571defd30c72dee512c1470b43cc4a537c00ed8233e172380dcb66d10e48d

    • SHA512

      3834ee2645014e5f8fd37cf16fc06559c914de4de3a423945eaa9ed92593d3d35374004e897bbf2ac977d3a1e6befa1bffe748c28b04984c09dbf9a4cfe7bab2

    • SSDEEP

      1536:bjJbKQOqTjCEvR9VwO5ZbuOqxvv/kzLA/aZd/:/hjV9VwSZKOq9/aZ

    Score
    10/10
    ponydiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks