General

  • Target

    e61568d99934224b06ebd8ab5bc2521b_JaffaCakes118

  • Size

    97KB

  • Sample

    240917-fjb35awarn

  • MD5

    e61568d99934224b06ebd8ab5bc2521b

  • SHA1

    64ad5ab67eecff4cfca1b197e5e4a307cfb09c7b

  • SHA256

    b586ad2f95053a5b0656b1e4972b1eef994c7b15517204504bfc16cf4a8c30fd

  • SHA512

    908ad51aef5ba9f0159b1865ad7db6cc0c7409addec8b141592b64c52a1cb211792a4b0044c9ec2c50acbf1f555d850894d916dd9b8dd9e69a17bc7c6181516c

  • SSDEEP

    1536:5z5q7p+0xy5pn0pHYbcM80BPrYGpqiNN+xfnCnenYeq9g7jfP3fsh4MmKXgd:xlelHYbcM/BjTdyCneU9g/fq9gd

Malware Config

Extracted

Family

pony

C2

http://bam.com.es:8383/pony/gate.php

http://home.creation.lt:8080/pony/gate.php

Attributes
  • payload_url

    http://hosting1554269.az.pl/j5EGyoC.exe

    http://spiritfinancial.net/JqLBEaNt.exe

Targets

    • Target

      e61568d99934224b06ebd8ab5bc2521b_JaffaCakes118

    • Size

      97KB

    • MD5

      e61568d99934224b06ebd8ab5bc2521b

    • SHA1

      64ad5ab67eecff4cfca1b197e5e4a307cfb09c7b

    • SHA256

      b586ad2f95053a5b0656b1e4972b1eef994c7b15517204504bfc16cf4a8c30fd

    • SHA512

      908ad51aef5ba9f0159b1865ad7db6cc0c7409addec8b141592b64c52a1cb211792a4b0044c9ec2c50acbf1f555d850894d916dd9b8dd9e69a17bc7c6181516c

    • SSDEEP

      1536:5z5q7p+0xy5pn0pHYbcM80BPrYGpqiNN+xfnCnenYeq9g7jfP3fsh4MmKXgd:xlelHYbcM/BjTdyCneU9g/fq9gd

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.