General

  • Target

    b42d768f225763c211ca24f06ce4c1f0_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240616-sm5aasyale

  • MD5

    b42d768f225763c211ca24f06ce4c1f0

  • SHA1

    8b502fe257295dc1ab658eb7660edd229f7b3cd1

  • SHA256

    2383a522e4b2f33f7384a58aeb4abaaeaa677f9f44f92ef34b71c2ba3ceed3d5

  • SHA512

    14ab76d2513b420b8756e3bf4b67e465372ee09af188a2aa0b9c7557ef4b3fffbceaaa55171e590fb61bc59135c5eef6e09b46b0038ad2cfaa0fc2b63980bee5

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwV

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      b42d768f225763c211ca24f06ce4c1f0_JaffaCakes118

    • Size

      2.2MB

    • MD5

      b42d768f225763c211ca24f06ce4c1f0

    • SHA1

      8b502fe257295dc1ab658eb7660edd229f7b3cd1

    • SHA256

      2383a522e4b2f33f7384a58aeb4abaaeaa677f9f44f92ef34b71c2ba3ceed3d5

    • SHA512

      14ab76d2513b420b8756e3bf4b67e465372ee09af188a2aa0b9c7557ef4b3fffbceaaa55171e590fb61bc59135c5eef6e09b46b0038ad2cfaa0fc2b63980bee5

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwV

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks