pony | 9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118

General

Target
9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118
Size 32KB
Sample240611-esjc5ateph
SHA256 29281df40b5939037b607315018e46c7e957bc649f063c2cec4797386dd81876
MD5 9cf3af0fcd58efd1910cab7220181ab0
SHA1 50d82a0f2400d4c7b299837e95e9e66355685a35
SHA512 12f9cde1cc4846243466ce595f0fb8a57be15008361d91fccafa55b1bca3d87d8318a65e3fc4a54933da66f40cef042ac6963fc27afc3a8a0fe0981574a81b75
SSDEEP 768:GVkwuewsQR41hmSY6+5ozxy7fVT1LAPJI05pXr/Pa:GVkrewsb17Y67zxyr4PiExja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx pony

Malware Config

Extracted

Family

pony

C2

http://flamezserver.com/pony/2/Panel/gate.php

Signatures

Pony family
pony

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Debit Advise3262.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Debit Advise3262.exe
unpack002/out.upx

File Explorer

9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118

.zip 32KB
Debit Advise3262.exe

.exe 34KB
out.upx

.exe 88KB

9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118

SHA256 29281df40b5939037b607315018e46c7e957bc649f063c2cec4797386dd81876
MD5 9cf3af0fcd58efd1910cab7220181ab0
SHA1 50d82a0f2400d4c7b299837e95e9e66355685a35
SHA512 12f9cde1cc4846243466ce595f0fb8a57be15008361d91fccafa55b1bca3d87d8318a65e3fc4a54933da66f40cef042ac6963fc27afc3a8a0fe0981574a81b75
SSDEEP 768:GVkwuewsQR41hmSY6+5ozxy7fVT1LAPJI05pXr/Pa:GVkrewsb17Y67zxyr4PiExja
MD5 SHA1 SHA512 SSDEEP

Debit Advise3262.exe

SHA256 54008644fd18ca4cd23a0341fc1a7cdba0bfdaa816dfd6ae61417aa366c684dd
MD5 2b5b478de74288783e3248db18bcd993
SHA1 e05230ac1e55a2f91281bc4b040e353cf0459acc
SHA512 db6c85518f08300ef9d0214f5b9d9cda835837424ae62095989927ed3aab0e1a58b023223d5ed4d50e01cf64fc42cf4873bc001c1d94de8391a35b6e96bc89ad
SSDEEP 384:NI12X4zCEIqSAGs6JyIRF+yJ3qIRWxlMrc+/fUblkTWL3/ALVOhP3jZdYych+DpQ:NIwoPIA6yqoMwqpTY345idYfYoNqKNo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

110272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 65b6dd289f1be174afb4ebacf5590ab336e4f4b47d5b14fac05cb392cc717566
MD5 de3c89ad9e483750716dadf401acc8bb
SHA1 004d99afe108b415bb93b6c140a01bcbfeb50848
SHA512 786d85dbfae9671bb9d68d594b94e464736e5f5cc4b93634825e7ec473b49d445a11e81a44e4f7e7b8460dc178d4e41fa313d11b3b739899d8e459ab6a67cddc
SSDEEP 1536:YXqG8+RqTm98AhLzZhPi78Pfy9Mdnt6e1IzUHNOts6qGTv8EOUkzmB:emaXhE8PK9MjO8LEO4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

65273

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118

Debit Advise3262.exe

generic

out.upx

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

9cf3af0fcd58efd1910cab7220181ab0_JaffaCakes118

Debit Advise3262.exe

generic

out.upx

generic