General

  • Target

    d75ca46752544fa41adfff58728312f6_JaffaCakes118

  • Size

    128KB

  • Sample

    240910-a7ek9szhqf

  • MD5

    d75ca46752544fa41adfff58728312f6

  • SHA1

    a986f0a75fd6379297455c6819c585194903385a

  • SHA256

    760b43ad407594a4addce8e3e20d90d739666e91f7dbea394f6eda6d9c9a0d40

  • SHA512

    57716344a11e80eb24ba57b53e9c57b8c9223bc19d71a8f0a82a0f432392b07830bac414279b1a6d47ee0803e1cb85de915778f8788b6e45a567bf136b7bd319

  • SSDEEP

    3072:uGHi6mw6NFC+Nzs57Y7cZTwqh4xEiUoF4TDwUr58ngej6:+tNLzs57Y7c1TiDUdTDun7

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php

Attributes
  • payload_url

    http://www.chandlerbacker.com/J9K.exe

    http://bobinlaminasyonmakinalari.com/o9RYHbCx.exe

    http://broadbentcompany.wsisrdev.com/KbGb.exe

Targets

    • Target

      d75ca46752544fa41adfff58728312f6_JaffaCakes118

    • Size

      128KB

    • MD5

      d75ca46752544fa41adfff58728312f6

    • SHA1

      a986f0a75fd6379297455c6819c585194903385a

    • SHA256

      760b43ad407594a4addce8e3e20d90d739666e91f7dbea394f6eda6d9c9a0d40

    • SHA512

      57716344a11e80eb24ba57b53e9c57b8c9223bc19d71a8f0a82a0f432392b07830bac414279b1a6d47ee0803e1cb85de915778f8788b6e45a567bf136b7bd319

    • SSDEEP

      3072:uGHi6mw6NFC+Nzs57Y7cZTwqh4xEiUoF4TDwUr58ngej6:+tNLzs57Y7c1TiDUdTDun7

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks