Overview

overview

10

Static

static

10

bfcfd70439...18.exe

windows7-x64

10

bfcfd70439...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bfcfd70439398835c161560743b54029_JaffaCakes118

  • Size

    92KB

  • MD5

    bfcfd70439398835c161560743b54029

  • SHA1

    54d6ca50ede79092e822e6f79b3db4d0204c6a3f

  • SHA256

    4c61dc28b8670b30deee98e6ebb151c0990e57785f57b9b39bf2a3c34dcfc5af

  • SHA512

    1c413f3cc79a6e3aad940eb2bdfea12d906be0b85de549a64759935dc12c9f92f2019db829e7bf3a8914a43c8426db1a69ff57ee29fff03f228f5f275e1cc97f

  • SSDEEP

    1536:hrSon3fOqTr5NFaIQVZPR10EPryyzxKSc44oxCsXWGgfCOyKwCTTvp5EOgRSeI3t:VDfZRQV29yzxKS2CCxCOd55EOgRSeI3t

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://www.rpc-ea.com:8080/forum/viewtopic.php

http://213.186.47.54:8080/forum/viewtopic.php

http://allods.oxid-gaming.de:8080/forum/viewtopic.php

http://24.bodytitenewportbeach.com/forum/viewtopic.php
Attributes
  • payload_url

    http://infoshore.biz/cx5oMi.exe

    http://www.qualitymachineinc.com/QabtyY.exe

    http://icnaeast.org/T6986MEr.exe

    http://crownglobalpromotionassociates.com/TMJCBc.exe

    http://168.144.167.58/VjdJ.exe

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bfcfd70439398835c161560743b54029_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    8ccde584db2b33df6901142bba965604


    Headers

    Imports

    Sections