General

  • Target

    50d25f4d1df9b29cdb291b65062efbce_JaffaCakes118

  • Size

    90KB

  • Sample

    240517-wv39racc76

  • MD5

    50d25f4d1df9b29cdb291b65062efbce

  • SHA1

    3065dff3b87f66297d1e4e7b1ede3e311d9b70e5

  • SHA256

    cccec26f1a45d64338ec56624b29d13e72736e5795412975da4c279b663763eb

  • SHA512

    fd5d402d5563b7b0a5da60d902c4d0af50fb2b91f43af2cfeb631e27b8f734eae6ccef5d7f3d4e44283c92ad241c71df932141f6d59772ee4126ad5d9bffbf36

  • SSDEEP

    1536:inCDLwy6qTW/vUb+GiBO/WXaJkUgdJ4EiONdR85TvoEAYkzmdx:MCDjuUSBBO/me7ayO3EAkdx

Malware Config

Extracted

Family

pony

C2

http://cb94336.tmweb.ru/moneylong/benzes/gate.php

Attributes
  • payload_url

    http://cq78109.tmweb.ru/newmoneyy/arabmoney/micro.exe

Targets

    • Target

      50d25f4d1df9b29cdb291b65062efbce_JaffaCakes118

    • Size

      90KB

    • MD5

      50d25f4d1df9b29cdb291b65062efbce

    • SHA1

      3065dff3b87f66297d1e4e7b1ede3e311d9b70e5

    • SHA256

      cccec26f1a45d64338ec56624b29d13e72736e5795412975da4c279b663763eb

    • SHA512

      fd5d402d5563b7b0a5da60d902c4d0af50fb2b91f43af2cfeb631e27b8f734eae6ccef5d7f3d4e44283c92ad241c71df932141f6d59772ee4126ad5d9bffbf36

    • SSDEEP

      1536:inCDLwy6qTW/vUb+GiBO/WXaJkUgdJ4EiONdR85TvoEAYkzmdx:MCDjuUSBBO/me7ayO3EAkdx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks