General

  • Target

    e36c66e0f3850a6f5184246f65b629ea_JaffaCakes118

  • Size

    143KB

  • Sample

    240915-1nsa5avdkj

  • MD5

    e36c66e0f3850a6f5184246f65b629ea

  • SHA1

    7eb140fb3c957fab37f41455b3d1065b3d945958

  • SHA256

    c286c5407b96a9e07dd04145aa425c578a49f225eecfa292453f5e2a67a7d7a3

  • SHA512

    dc6a3796c370b8ee6167be34dc9741f84de8619e8f6eb76e51161d1b817f414646b79da55a102e74030e9d1c28ccffe9bda1b1d50756b7f1e638b2378d5b4726

  • SSDEEP

    1536:gcZLLYJV9ZqbHDQGks1mdbeBJoAbvydUA6uxYDrP1hRRzWZYArk+jQoU0ZP/qvIW:xLLUuSnqSMvzA66A7LleQoU0ZPc/xP

Malware Config

Extracted

Family

pony

C2

http://www.alberghi.com:8080/pony/gate.php

http://buyandsmile.atomclick.co:8080/pony/gate.php

Attributes
  • payload_url

    http://contabilidadesr.com.br/1mmF86V8/Vdqu.exe

    http://www.vandenboschelektro.be/vgwCwvDs/Y9fNYJCs.exe

    http://geovanabauerdocesfinos.com.br/6md3zev5/hQj.exe

Targets

    • Target

      e36c66e0f3850a6f5184246f65b629ea_JaffaCakes118

    • Size

      143KB

    • MD5

      e36c66e0f3850a6f5184246f65b629ea

    • SHA1

      7eb140fb3c957fab37f41455b3d1065b3d945958

    • SHA256

      c286c5407b96a9e07dd04145aa425c578a49f225eecfa292453f5e2a67a7d7a3

    • SHA512

      dc6a3796c370b8ee6167be34dc9741f84de8619e8f6eb76e51161d1b817f414646b79da55a102e74030e9d1c28ccffe9bda1b1d50756b7f1e638b2378d5b4726

    • SSDEEP

      1536:gcZLLYJV9ZqbHDQGks1mdbeBJoAbvydUA6uxYDrP1hRRzWZYArk+jQoU0ZP/qvIW:xLLUuSnqSMvzA66A7LleQoU0ZPc/xP

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks