Overview

overview

10

Static

static

1

2ba0d72477...18.exe

windows7-x64

10

2ba0d72477...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2ba0d724779d32c5cc7e1eb3974232a0_JaffaCakes118

  • Size

    148KB

  • Sample

    240708-j8sc7azhkm

  • MD5

    2ba0d724779d32c5cc7e1eb3974232a0

  • SHA1

    92e9d67d140108763420d32904a7c5d23f71161a

  • SHA256

    7b29c8456c44cfa4b5791e6a27e992547f3ff8a9eb00178d21dd3b5ad75ea789

  • SHA512

    1cbbcf7abde088b6acffbc708154e8fae94189328b08faae9d53edafc757c656149313764fee9311841ffb6b2e46a40698aa0644ae8f9c91fbd43c941e239442

  • SSDEEP

    3072:wE10YjbWK7kiDS7oglIVVqeeOeQsuaIZIGltgp+/PTNP:wspDCogyQlQsuRHx

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://178.32.160.255:8080/pony/gate.php

http://88.85.99.44:8080/pony/gate.php
Attributes
  • payload_url

    http://9arti10.com/M6pjf7E3/deLbk.exe

    http://santacasaitajuba.com.br/WBoTANuY/hBhT7.exe

    http://elespacio.telmexla.net.co/sNxQTzEK/bHk6KE.exe

Targets

    • Target

      2ba0d724779d32c5cc7e1eb3974232a0_JaffaCakes118

    • Size

      148KB

    • MD5

      2ba0d724779d32c5cc7e1eb3974232a0

    • SHA1

      92e9d67d140108763420d32904a7c5d23f71161a

    • SHA256

      7b29c8456c44cfa4b5791e6a27e992547f3ff8a9eb00178d21dd3b5ad75ea789

    • SHA512

      1cbbcf7abde088b6acffbc708154e8fae94189328b08faae9d53edafc757c656149313764fee9311841ffb6b2e46a40698aa0644ae8f9c91fbd43c941e239442

    • SSDEEP

      3072:wE10YjbWK7kiDS7oglIVVqeeOeQsuaIZIGltgp+/PTNP:wspDCogyQlQsuRHx

    Score
    10/10
    ponydiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks