Overview

overview

10

Static

static

10

59a7c92746...18.exe

windows7-x64

10

59a7c92746...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59a7c92746808063cef23487b7978853_JaffaCakes118

  • Size

    91KB

  • MD5

    59a7c92746808063cef23487b7978853

  • SHA1

    d9fed1fb3672976dce3e1c277e9333ec4496edcc

  • SHA256

    67fe17a7cfd78582017463b7a82f288e861027797279572b1eb047bf32986f20

  • SHA512

    eec7fce6e878dd308351ddfc1aeeed0301e5198781f4040f8f7ebfe609c6f6aab27a1ebe8f562046c1dd96fa46093d01b9a49612fbe310041c9fd9860cddc870

  • SSDEEP

    1536:wSv9e7gumqToINZSRP+FP/bJXzrpSO58BDPy7htpFREbOQMpeTvXEwokzm+t:9Pun4P+1JXzrpSHby7ObOvkEwUC

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://www.awdoh-cpa.com:8080/forum/viewtopic.php

http://195.225.168.127:8080/forum/viewtopic.php

http://tracciatoecm.it:8080/forum/viewtopic.php

http://209.114.32.36:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://sjr-offenbach.de/6HAt3sXp.exe

    http://www.hutwaltraud.de/GpWX8yo.exe

    http://industrial.uc-se.com/f8mg.exe

    http://www.bvb-auguren.de/kang.exe

    http://krischker.boxler-online.de/wsTEBf1.exe

    http://scored202.org/Dia0h.exe

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 59a7c92746808063cef23487b7978853_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    8ccde584db2b33df6901142bba965604


    Headers

    Imports

    Sections