General

  • Target

    a13d5374adf400bf521dc004804d0abb_JaffaCakes118

  • Size

    2.6MB

  • Sample

    240612-tedcaavcjm

  • MD5

    a13d5374adf400bf521dc004804d0abb

  • SHA1

    334a6ee872fe49f5a98494c93aa39d99c50ee235

  • SHA256

    5b8dc985ed17848aff0d4db08a593d28c4474b2839dafe607bffa09c7a72fe74

  • SHA512

    2b9d10cadd94fe5533c1f095ed84f34f6eb5d9e8d8faf50f1b3bc2817872f8f9b000d7c951d6f69d27ffe2302b7495b9a151387f0113ca46b7df4714e4feae10

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      a13d5374adf400bf521dc004804d0abb_JaffaCakes118

    • Size

      2.6MB

    • MD5

      a13d5374adf400bf521dc004804d0abb

    • SHA1

      334a6ee872fe49f5a98494c93aa39d99c50ee235

    • SHA256

      5b8dc985ed17848aff0d4db08a593d28c4474b2839dafe607bffa09c7a72fe74

    • SHA512

      2b9d10cadd94fe5533c1f095ed84f34f6eb5d9e8d8faf50f1b3bc2817872f8f9b000d7c951d6f69d27ffe2302b7495b9a151387f0113ca46b7df4714e4feae10

    • SSDEEP

      49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks