Overview

overview

10

Static

static

3

347ba32479...18.exe

windows7-x64

10

347ba32479...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    347ba324794882769258e242e6cdde26_JaffaCakes118

  • Size

    128KB

  • Sample

    240710-nbf14swgje

  • MD5

    347ba324794882769258e242e6cdde26

  • SHA1

    7ef9d24f123f03f72e895638f3528214225c24ce

  • SHA256

    42a2c041602e5afbb48e9450ed2e66c0e535fe90640c7873801163ad52274c40

  • SHA512

    1da15c14efe90c6b5d8286b9fd0393ef7907d8d501b604f42d4cee4cd96dcf4830d5dfee58e9d411ba7b208d7e9496aafbfd24440aca5b9deb91e17779e2b269

  • SSDEEP

    3072:uGHi6mwgnMCiGnivTqE5XxnptiaxHPTvFG/W:+PnQGnibqEdti0TvFw

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php
Attributes
  • payload_url

    http://fuerzav.vectorialstudios.com/4Gxf.exe

    http://riegotec.com.mx/fgGq.exe

    http://modaitaliaclub.com/LdKtM6.exe

    http://successwithmichael.com/Dj8vftG.exe

    http://piscinasangra.com/oP3yge.exe

    http://p933.phpnet.org/0uVk8W2Z.exe

Targets

    • Target

      347ba324794882769258e242e6cdde26_JaffaCakes118

    • Size

      128KB

    • MD5

      347ba324794882769258e242e6cdde26

    • SHA1

      7ef9d24f123f03f72e895638f3528214225c24ce

    • SHA256

      42a2c041602e5afbb48e9450ed2e66c0e535fe90640c7873801163ad52274c40

    • SHA512

      1da15c14efe90c6b5d8286b9fd0393ef7907d8d501b604f42d4cee4cd96dcf4830d5dfee58e9d411ba7b208d7e9496aafbfd24440aca5b9deb91e17779e2b269

    • SSDEEP

      3072:uGHi6mwgnMCiGnivTqE5XxnptiaxHPTvFG/W:+PnQGnibqEdti0TvFw

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks