General

  • Target

    80bab323103e8212f7f624b8cac39b68_JaffaCakes118

  • Size

    160KB

  • Sample

    240529-pmf1xsfa39

  • MD5

    80bab323103e8212f7f624b8cac39b68

  • SHA1

    121f0d444114ab55c45c954233f57dc5f3406dae

  • SHA256

    a1cc67c8713bb30d005de080255b1f811b9b1d6d91ea182b49c7496260f651cc

  • SHA512

    9ee37553f417be3d17bba60b8945ec49bf072ec594a429669c9c9ec7291f6cb89998b31debac42224d79fca48253c497778389cddc8acfefd87ae6680206698e

  • SSDEEP

    3072:Pa5YpKseKiYoMSjEDb/aQZ9J8jLbud45MW64JdeDRUcPvqXc:PlV1NoMSj+b/aE9cbudsj64JdCRUCqM

Malware Config

Extracted

Family

pony

C2

http://genic-enterprises.website/www/gate.php

Targets

    • Target

      Pony.exe

    • Size

      89KB

    • MD5

      ca381a2a93d10d033ba1251927c38775

    • SHA1

      8d6e345bdb55002779304519f026fb4b4e67d128

    • SHA256

      f508aab83a08d9a8d9f2274bc967cba51dde8c9e045bcc647df061d86a186f1b

    • SHA512

      85b6339bdbec8ac014439df73f9ef062139c8197023bdc1f703448b95f1d4dc5a01e7aba9093ef6934aa94089c5319ee3f5384e4f479b94f5004e3c5d59e6fa8

    • SSDEEP

      1536:HEAwP87MqTbX+ZlIk8q0pTs/XS+z1F+OXBbGTv8E6hkzm8Ty:kAnaA3p4wOpE69X

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks