General

  • Target

    570d821f4dbbaced91589426f430ff08_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240518-12acgaac41

  • MD5

    570d821f4dbbaced91589426f430ff08

  • SHA1

    5218f590b969978196dadeea79beb2105aa80aae

  • SHA256

    cca041e34546ca2022b7abbd6958921809b717c0c399832f1a162412d3be07b9

  • SHA512

    ba361546bbf0d075287864ad8c4ced460c22e0eedff8477d652314772e63ced245f4dba48f65f297ce2d005641619c9ef41f29bc2ceab59fbe4026ac24596617

  • SSDEEP

    24576:etfBAkaJBIrFPVCEJZBoYLpKSgCCICW4NFoSntVjc2BxQpOx10s6tFMqQH:WraJyFPVlJxLpfc5Ft1ciQk3H

Malware Config

Extracted

Family

pony

C2

http://tcoolonline.mobi/wp-includes/css/Panel/gate.php

Targets

    • Target

      Total order confirmation April 10 2017.exe

    • Size

      1.5MB

    • MD5

      d31daa3adb9285b7024438799d3a7fc8

    • SHA1

      3a4a3684c7a475bae5b47aad1ad750996add764b

    • SHA256

      ebdb910c35ce8b21168a4bda0dae16b3a64f66670763be89a81e322d8ddab431

    • SHA512

      9d3febe2e0603e0f6d040dff42b194fa2be309260724f9bfc879fd72990718145a239a6817b8fbcf1fd1c2e3209896c94282fc88e9bc61d064b393f0b271d8dc

    • SSDEEP

      49152:41wV28FzbXmsC/C2d4A7k5r3HN2i54kZW:VVvFzisC/r4UkJ3HN2i54mW

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Luminosity

      Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks