Overview

overview

10

Static

static

3

2ec1e873c4...18.exe

windows7-x64

10

2ec1e873c4...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2ec1e873c49df6d9c1106fab355fa02d_JaffaCakes118

  • Size

    128KB

  • Sample

    240709-dezyaasgll

  • MD5

    2ec1e873c49df6d9c1106fab355fa02d

  • SHA1

    3cb0a139e63d42bb3a44adbc92a18ebd79fd9d9b

  • SHA256

    8c8f9fd015668e49da089190aa9768c4ee6f666dcc8b8feb2162976e8b6ef907

  • SHA512

    1ec203489d974b83f948440a91748e00224165a8eae50f5724d40af4f952572679ab2d68c20bacdf3fb5446f0d46e7109716bfa99568283d8a1247b72adabd84

  • SSDEEP

    3072:uGHi6mwg5MpG5bH9JTzIVY2h5ecRlOWAqChXpw95:+j5t5bH9JT0h59OWAq

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://69.194.193.166/forum/viewtopic.php
Attributes
  • payload_url

    http://ctl-mexico.com/WtgME.exe

    http://cvilleshootingstars.com/JzU.exe

    http://ctamdq.org.ar/bigQm.exe

Targets

    • Target

      2ec1e873c49df6d9c1106fab355fa02d_JaffaCakes118

    • Size

      128KB

    • MD5

      2ec1e873c49df6d9c1106fab355fa02d

    • SHA1

      3cb0a139e63d42bb3a44adbc92a18ebd79fd9d9b

    • SHA256

      8c8f9fd015668e49da089190aa9768c4ee6f666dcc8b8feb2162976e8b6ef907

    • SHA512

      1ec203489d974b83f948440a91748e00224165a8eae50f5724d40af4f952572679ab2d68c20bacdf3fb5446f0d46e7109716bfa99568283d8a1247b72adabd84

    • SSDEEP

      3072:uGHi6mwg5MpG5bH9JTzIVY2h5ecRlOWAqChXpw95:+j5t5bH9JT0h59OWAq

    Score
    10/10
    ponyratspywarestealercollectiondiscovery

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks