General

  • Target

    a0a69944b8356d922396a108113d4f05_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240612-ph7m3svbma

  • MD5

    a0a69944b8356d922396a108113d4f05

  • SHA1

    2232246b3b6a8284fe222927cfd62d5486a57ea6

  • SHA256

    7a29123f6df6bca1b2c5b72506d40f536a00ac20f92b54fe08b6ec54b0f663fb

  • SHA512

    a99566969569c57fa0c58d9295adb2d3515a3128b3870419b7c13fdf6d5ba342ad5b9c9c6d94c16c611b7e1ce7af2b8ea2c400e57678465c3a630575b3c50a9d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      a0a69944b8356d922396a108113d4f05_JaffaCakes118

    • Size

      2.2MB

    • MD5

      a0a69944b8356d922396a108113d4f05

    • SHA1

      2232246b3b6a8284fe222927cfd62d5486a57ea6

    • SHA256

      7a29123f6df6bca1b2c5b72506d40f536a00ac20f92b54fe08b6ec54b0f663fb

    • SHA512

      a99566969569c57fa0c58d9295adb2d3515a3128b3870419b7c13fdf6d5ba342ad5b9c9c6d94c16c611b7e1ce7af2b8ea2c400e57678465c3a630575b3c50a9d

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks