General

  • Target

    a058f4e2e8d8097b555983ef944d43de_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240612-mngmqsvemm

  • MD5

    a058f4e2e8d8097b555983ef944d43de

  • SHA1

    96eee644c168728821d24d16fa9e57360220c65b

  • SHA256

    1057a85cfc7393f81f0a8cb66c08a277d61bda65fe61ca5017c5437346ed48ec

  • SHA512

    a7a7f422d4ff28a2c7a4453df399a6f57270fc044e5e32c180d2d98e597bf13c922ee811404770a511e1ace03944667239b508dab1e2039332f36acefcab7ead

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwI

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      a058f4e2e8d8097b555983ef944d43de_JaffaCakes118

    • Size

      2.2MB

    • MD5

      a058f4e2e8d8097b555983ef944d43de

    • SHA1

      96eee644c168728821d24d16fa9e57360220c65b

    • SHA256

      1057a85cfc7393f81f0a8cb66c08a277d61bda65fe61ca5017c5437346ed48ec

    • SHA512

      a7a7f422d4ff28a2c7a4453df399a6f57270fc044e5e32c180d2d98e597bf13c922ee811404770a511e1ace03944667239b508dab1e2039332f36acefcab7ead

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwI

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks