Overview

overview

10

Static

static

10

8b6b0f89a4...18.exe

windows7-x64

10

8b6b0f89a4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b6b0f89a45cdb72842ec9ff5b7d6e00_JaffaCakes118

  • Size

    90KB

  • MD5

    8b6b0f89a45cdb72842ec9ff5b7d6e00

  • SHA1

    83a27635494b6ee45d6713e6a3e3d1a70004c143

  • SHA256

    b099d492f28f57c7c9ad1b0fa9851d353d621324860e8e6dd4d0b0a2327c5006

  • SHA512

    b2e1981d7aa893a3fa11df4774f13ab7472dba2b439fdcb49f9059990eedbab640a8d2c575cf6dec3e462dbaf7fa6856e2bdc6e21c28d3c6cc5127ec395f03ef

  • SSDEEP

    1536:BQj3Oci8zqTVxlVO6bfz6ZEGkM0+uN/Kqqb1IOWk3CTviEyikzZE:W7W8G3bfz6eGkx+w/KcOW6JEytE

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://srv.michigancrotchrockets.com/forum/viewtopic.php

http://srv.michigansuperbikes.com/forum/viewtopic.php
Attributes
  • payload_url

    http://apasaweb.com/JMwPrNzg.exe

    http://rochanhouse.com/VMS.exe

    http://www.as-you-likeit.co.uk/STPRvE6.exe

    http://kipadanceacademy.com/crvFb.exe

    http://nesamithran.com/eBB.exe

    http://william.one2.it/s74ZVST.exe

    http://adanadakidershaneler.com/vjsL.exe

    http://www.qtsinc.net/R2o.exe

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8b6b0f89a45cdb72842ec9ff5b7d6e00_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    2c8567c932832b8c3359ddf9343a4028


    Headers

    Imports

    Sections