Overview

overview

10

Static

static

3

322aa17d62...18.exe

windows7-x64

10

322aa17d62...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    322aa17d6242401a208c85dcbce7204e_JaffaCakes118

  • Size

    161KB

  • Sample

    240709-127b7syekk

  • MD5

    322aa17d6242401a208c85dcbce7204e

  • SHA1

    7aa429243489e625f0cb3564a98bdfec7f26d330

  • SHA256

    6f4a6b9c7f0f31c0190e99b5f9f5554d5435f261419011fba2cba8abd7af851d

  • SHA512

    2b81fe5379f4d9b9e4e6ebb8fa3791c2d4a20c1d430a9de9cba068e5f0b21dbf220f85707c982a312667f1164a091ec67e3a968516a96a038de40f84bd21a6dd

  • SSDEEP

    3072:6/RTnTj5E9m3iNEED9rW8fC/YUpmYBb+kF:CRIm3eDhvET

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://209.59.219.1/ponys/gate.php

http://212.58.20.11/ponys/gate.php
Attributes
  • payload_url

    http://bde-essec.com/1ePZ.exe

    http://datamidiaprojecoes.com.br/Axws.exe

    http://travelbuoy.com/Gi9M.exe

    http://www.katesmentionables.com/ppbkcRV4.exe

    http://seo.co.it/WarRVVtw.exe

Targets

    • Target

      322aa17d6242401a208c85dcbce7204e_JaffaCakes118

    • Size

      161KB

    • MD5

      322aa17d6242401a208c85dcbce7204e

    • SHA1

      7aa429243489e625f0cb3564a98bdfec7f26d330

    • SHA256

      6f4a6b9c7f0f31c0190e99b5f9f5554d5435f261419011fba2cba8abd7af851d

    • SHA512

      2b81fe5379f4d9b9e4e6ebb8fa3791c2d4a20c1d430a9de9cba068e5f0b21dbf220f85707c982a312667f1164a091ec67e3a968516a96a038de40f84bd21a6dd

    • SSDEEP

      3072:6/RTnTj5E9m3iNEED9rW8fC/YUpmYBb+kF:CRIm3eDhvET

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks