Overview

overview

10

Static

static

1

4244a2a782...18.exe

windows7-x64

10

4244a2a782...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4244a2a78256f160f12ebf4b9c2edf68_JaffaCakes118

  • Size

    116KB

  • Sample

    240713-swe2rswflj

  • MD5

    4244a2a78256f160f12ebf4b9c2edf68

  • SHA1

    5f1cccd3d224daa135244922da930fe5d09ee5f4

  • SHA256

    49fa2bf6b31a30c34c4af237478a834dfb4f657933e50e9c44f5851ff82bbf74

  • SHA512

    01261ca01311dbcac583ccb984ec0e044eed5544db8a32482741040b75ec64029298014a239da76b179198772cb951ddd91e7464a9105e60b3aceae2c39c9ade

  • SSDEEP

    3072:auXFH83lvQ4rCynrENURgLKbaqlkmXeT83eh9KcaeXEmgTA:4lv33WGeVmuTBycOC

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://176.28.18.135:8080/pony/gate.php

http://85.214.243.87:8080/pony/gate.php

http://88.85.99.44:8080/pony/gate.php
Attributes
  • payload_url

    http://heartforghana.com/ut8XxZ3R/sssNU.exe

    http://galati-anunturi.ro/ZB63U9W7/LDKnwr.exe

Targets

    • Target

      4244a2a78256f160f12ebf4b9c2edf68_JaffaCakes118

    • Size

      116KB

    • MD5

      4244a2a78256f160f12ebf4b9c2edf68

    • SHA1

      5f1cccd3d224daa135244922da930fe5d09ee5f4

    • SHA256

      49fa2bf6b31a30c34c4af237478a834dfb4f657933e50e9c44f5851ff82bbf74

    • SHA512

      01261ca01311dbcac583ccb984ec0e044eed5544db8a32482741040b75ec64029298014a239da76b179198772cb951ddd91e7464a9105e60b3aceae2c39c9ade

    • SSDEEP

      3072:auXFH83lvQ4rCynrENURgLKbaqlkmXeT83eh9KcaeXEmgTA:4lv33WGeVmuTBycOC

    Score
    10/10
    ponydiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks