General

  • Target

    a02a8aeb5f95dd7d7e54ccbd1d7c5569_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240612-ldqbfsxdlp

  • MD5

    a02a8aeb5f95dd7d7e54ccbd1d7c5569

  • SHA1

    af4df28b8e24c22e66989a621b60c3a34d5676e7

  • SHA256

    301f12ce31bb84cb36270fd2eb2d823871e0132e58a9c339ec53adfea709e62a

  • SHA512

    60d2e3eb6ad2189f773675337954522caaa4f36571eb7641360104e27b6027a4f8b23d192d781df7c86b26e82b08be154cf62f11b2d8e2159b4c2f8156f7f87e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwe

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      a02a8aeb5f95dd7d7e54ccbd1d7c5569_JaffaCakes118

    • Size

      2.2MB

    • MD5

      a02a8aeb5f95dd7d7e54ccbd1d7c5569

    • SHA1

      af4df28b8e24c22e66989a621b60c3a34d5676e7

    • SHA256

      301f12ce31bb84cb36270fd2eb2d823871e0132e58a9c339ec53adfea709e62a

    • SHA512

      60d2e3eb6ad2189f773675337954522caaa4f36571eb7641360104e27b6027a4f8b23d192d781df7c86b26e82b08be154cf62f11b2d8e2159b4c2f8156f7f87e

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwe

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks