Overview

overview

10

Static

static

1

ed0e597c8f...18.exe

windows7-x64

10

ed0e597c8f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed0e597c8f3a2365d900aa31d29858a8_JaffaCakes118

  • Size

    137KB

  • Sample

    240920-hn58watela

  • MD5

    ed0e597c8f3a2365d900aa31d29858a8

  • SHA1

    1b87bf2a1e60e81864006240c8c3636a91db0da6

  • SHA256

    23521738df3f3539a247878d53701de59ff20bcb4f3bbd425f443a717e5bc28f

  • SHA512

    1f179f1fe005baf03a3a848e879bacbb055d8658cf8a3e64f1b7d663869176326a9eb843a41719c6df1b77b245fc667b9640c321e117b1736556d3f7b48e1c4b

  • SSDEEP

    3072:6yLhtUlHAnBYOEHEbAuqAwI80WMbKLfLlZh/6ru:6OUlgnaBEczr0aLDN/P

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://www.alberghi.com:8080/pony/gate.php

http://buyandsmile.atomclick.co:8080/pony/gate.php
Attributes
  • payload_url

    http://ftp.eburneenne.com/7zBY7xS.exe

    http://www.spetter.com/mi19YgV.exe

    http://photosfoto.com/uTM.exe

    http://www.daginternacional.com/trXe.exe

Targets

    • Target

      ed0e597c8f3a2365d900aa31d29858a8_JaffaCakes118

    • Size

      137KB

    • MD5

      ed0e597c8f3a2365d900aa31d29858a8

    • SHA1

      1b87bf2a1e60e81864006240c8c3636a91db0da6

    • SHA256

      23521738df3f3539a247878d53701de59ff20bcb4f3bbd425f443a717e5bc28f

    • SHA512

      1f179f1fe005baf03a3a848e879bacbb055d8658cf8a3e64f1b7d663869176326a9eb843a41719c6df1b77b245fc667b9640c321e117b1736556d3f7b48e1c4b

    • SSDEEP

      3072:6yLhtUlHAnBYOEHEbAuqAwI80WMbKLfLlZh/6ru:6OUlgnaBEczr0aLDN/P

    Score
    10/10
    ponydiscoveryratspywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks