Overview

overview

10

Static

static

10

002afe51b5...18.exe

windows7-x64

10

002afe51b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    002afe51b5762bbbb5b9ea3adb9a8d7f_JaffaCakes118

  • Size

    89KB

  • MD5

    002afe51b5762bbbb5b9ea3adb9a8d7f

  • SHA1

    08ad895a55b4c5213bea0e0d4aa2a4f2807453d4

  • SHA256

    ed1c0c6efe4543fe6f2a7ab9c23d2a7c8980b54d8c91282467b1d2998c72eeda

  • SHA512

    6a69b74d754b6e7edcf3db42870bb13f4ae3172602eaaadc7fbd91a9950bffec4d13d11f22e3aa92ca5729adf6168ee17c4198567f094cd2726ec5c6a803afd5

  • SSDEEP

    1536:1TfV30H1G7tqT3ngZcYYzdFDIJT+fuY/13GFGO+MUMTvCEyLkzZx:tVGybcYYzdFIJTQJ5O+xLEykx

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://forum-voip.com:8080/ponyb/gate.php

http://forum-voip.net:8080/ponyb/gate.php

http://paralysiesfaciale.com:8080/ponyb/gate.php

http://paralysiesfaciales.com:8080/ponyb/gate.php
Attributes
  • payload_url

    http://doguspastanesi.com/zWEzdm5z.exe

    http://powerworldauto.co.in/3CaUe9.exe

    http://otg1.com/h3WA.exe

    http://www.udxdirect.com/KBG.exe

    http://www.steuerberaterwj.de/zrWMoA9b.exe

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 002afe51b5762bbbb5b9ea3adb9a8d7f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    2c8567c932832b8c3359ddf9343a4028


    Headers

    Imports

    Sections