Overview

overview

10

Static

static

7

333898a63c...18.exe

windows7-x64

10

333898a63c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    333898a63cc9df2ae3a732a36a8b284c_JaffaCakes118

  • Size

    160KB

  • Sample

    240710-ej488sxdla

  • MD5

    333898a63cc9df2ae3a732a36a8b284c

  • SHA1

    62bf1662deaa4e64e9f1d3d5dcdb1fb8080c4852

  • SHA256

    b9467f2db740252613e72fc7cc441c46e6625730bab6e1331d3bd92079311721

  • SHA512

    3976f70a385baf9eefa94409f0306e084bc8e3f7e4060ed464df301d27dd9603858938289a6d09c3d58cf26bd3c607a8c977b754e69b5d845c252ea33e576ce4

  • SSDEEP

    3072:AuWJVrzbzQUi36YK2kKIsGcCoYxXSn2PNENxk5pNuPn2SSd:VWJVPj4kRT4CXLPNge

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://184.172.134.62:8080/pony/gate.php

http://108.178.59.22/pony/gate.php
Attributes
  • payload_url

    http://www.Quickinformatica.com.ar/bYrU2.exe

    http://ftp.acsb.com/VamXBi.exe

    http://organickitchen.com.my/0AJmGT3.exe

    http://melissena.by/84fG.exe

    http://ftp.maxicardbeneficios.com.br/hLCy.exe

    http://bss-ltd.eu/HR9808J.exe

    http://ragamkriya.com/KeTAD9s.exe

    http://dotykaniola.com/uAv.exe

    http://216.119.94.115/VU07R.exe

    http://fkatalog.pl/xroKHkt.exe

Targets

    • Target

      333898a63cc9df2ae3a732a36a8b284c_JaffaCakes118

    • Size

      160KB

    • MD5

      333898a63cc9df2ae3a732a36a8b284c

    • SHA1

      62bf1662deaa4e64e9f1d3d5dcdb1fb8080c4852

    • SHA256

      b9467f2db740252613e72fc7cc441c46e6625730bab6e1331d3bd92079311721

    • SHA512

      3976f70a385baf9eefa94409f0306e084bc8e3f7e4060ed464df301d27dd9603858938289a6d09c3d58cf26bd3c607a8c977b754e69b5d845c252ea33e576ce4

    • SSDEEP

      3072:AuWJVrzbzQUi36YK2kKIsGcCoYxXSn2PNENxk5pNuPn2SSd:VWJVPj4kRT4CXLPNge

    Score
    10/10
    ponycollectiondiscoveryratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks