General

  • Target

    17aa3ab06df05f25d63be19012c412a2_JaffaCakes118

  • Size

    113KB

  • Sample

    240627-1r4hkashke

  • MD5

    17aa3ab06df05f25d63be19012c412a2

  • SHA1

    1ed7f786c82363570a56b11e0cc358a9c615064e

  • SHA256

    6556238146126cb546f0f9ff33a15bc1759bbeb7742ca0c72074a308cee55845

  • SHA512

    0ca077cb3ca4553ae3064a0694fc24f3ef5b1b7b57708cb5ac2b4323f65a83e9cf636211dee396dc32f4568f6f12115b01caec0bd09e5d35b172fc31e7d6748a

  • SSDEEP

    3072:kTY7VKne2w1GBcMc0ToVA+6moAiKkj2Xa7Ur:sgVH2wcjc00B4yV

Malware Config

Extracted

Family

pony

C2

http://sam-latrilogie.com:8080/pony/gate.php

http://loceanic.fr:8080/pony/gate.php

Attributes
  • payload_url

    http://www.uniaotec.com.br/0Yoo6.exe

    http://216.119.80.138/KY5.exe

    http://ftp.videoheretic.com/vFs6cZZ.exe

Targets

    • Target

      17aa3ab06df05f25d63be19012c412a2_JaffaCakes118

    • Size

      113KB

    • MD5

      17aa3ab06df05f25d63be19012c412a2

    • SHA1

      1ed7f786c82363570a56b11e0cc358a9c615064e

    • SHA256

      6556238146126cb546f0f9ff33a15bc1759bbeb7742ca0c72074a308cee55845

    • SHA512

      0ca077cb3ca4553ae3064a0694fc24f3ef5b1b7b57708cb5ac2b4323f65a83e9cf636211dee396dc32f4568f6f12115b01caec0bd09e5d35b172fc31e7d6748a

    • SSDEEP

      3072:kTY7VKne2w1GBcMc0ToVA+6moAiKkj2Xa7Ur:sgVH2wcjc00B4yV

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks