General

  • Target

    ed7e57a03ed3e58e4128eb99dd8dc355_JaffaCakes118

  • Size

    95KB

  • Sample

    240920-nphf4avapq

  • MD5

    ed7e57a03ed3e58e4128eb99dd8dc355

  • SHA1

    2121c8b2441dfc70a35a3fda71a3a480616628fc

  • SHA256

    b70a9989ed724a7434ad18b7b7a6723b79ad7d8aab775aeb61c9c883b68e0c44

  • SHA512

    9d0b1960766ebc332715369e9a2acb02b77b06dd4db887a87f70211455288b5edb921c15428d9260479741c96ba420c20ab65f49f9ed3428489a5957948f381c

  • SSDEEP

    1536:Qqw+LCmF3f6gwyPwGAvOCRdikXZUkQLHgLdqA7TNezQPCIlEw+p+:XhL3CfyPwGAvO2dpUkQDgY8TNl5Kp+

Malware Config

Extracted

Family

pony

C2

http://88.85.99.44:8080/pony/gate.php

http://91.121.140.103:8080/pony/gate.php

http://91.121.178.156:8080/pony/gate.php

Attributes
  • payload_url

    http://www.appggs.it/bturFwVJ.exe

    http://gnarlybuys.info/LMbir.exe

    http://100s.pl/jQnoeUC.exe

    http://www.imobiliariacruzeirors.com.br/hEh0R.exe

Targets

    • Target

      ed7e57a03ed3e58e4128eb99dd8dc355_JaffaCakes118

    • Size

      95KB

    • MD5

      ed7e57a03ed3e58e4128eb99dd8dc355

    • SHA1

      2121c8b2441dfc70a35a3fda71a3a480616628fc

    • SHA256

      b70a9989ed724a7434ad18b7b7a6723b79ad7d8aab775aeb61c9c883b68e0c44

    • SHA512

      9d0b1960766ebc332715369e9a2acb02b77b06dd4db887a87f70211455288b5edb921c15428d9260479741c96ba420c20ab65f49f9ed3428489a5957948f381c

    • SSDEEP

      1536:Qqw+LCmF3f6gwyPwGAvOCRdikXZUkQLHgLdqA7TNezQPCIlEw+p+:XhL3CfyPwGAvO2dpUkQDgY8TNl5Kp+

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.