Overview

overview

10

Static

static

10

6bbd05b140...18.exe

windows7-x64

10

Resubmissions

23-05-2024 17:52

240523-wf6fkaba5v 10

23-05-2024 17:50

240523-weypbsba2v 10

23-05-2024 17:42

240523-v99jmsah35 10

23-05-2024 17:38

240523-v778ssag66 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bbd05b1405e17e9eade873efc9efdbe_JaffaCakes118

  • Size

    2.6MB

  • Sample

    240523-weypbsba2v

  • MD5

    6bbd05b1405e17e9eade873efc9efdbe

  • SHA1

    ba21b186744e4fb7b7a2dc7804d1f91d48181a22

  • SHA256

    b24a39285fa9c5bb8efb507fea064c05e05ab994e6607fe55a085ccbb0619c69

  • SHA512

    5420f76ffa9b231f408f4e816710dc80631ea8223846e0a97e121d1d84af2787686d86e81ab215f98ecc4ecb4c47b69512de4037e0f66c5a40ab7f443c8fcd04

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl9:86SIROiFJiwp0xlrl9

Score
10/10
ponyevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      6bbd05b1405e17e9eade873efc9efdbe_JaffaCakes118

    • Size

      2.6MB

    • MD5

      6bbd05b1405e17e9eade873efc9efdbe

    • SHA1

      ba21b186744e4fb7b7a2dc7804d1f91d48181a22

    • SHA256

      b24a39285fa9c5bb8efb507fea064c05e05ab994e6607fe55a085ccbb0619c69

    • SHA512

      5420f76ffa9b231f408f4e816710dc80631ea8223846e0a97e121d1d84af2787686d86e81ab215f98ecc4ecb4c47b69512de4037e0f66c5a40ab7f443c8fcd04

    • SSDEEP

      49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl9:86SIROiFJiwp0xlrl9

    Score
    10/10
    ponyevasionpersistenceratspywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks