Overview

overview

10

Static

static

10

f946210397...18.exe

windows7-x64

10

f946210397...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f946210397491f2bccc1afa83e76801d_JaffaCakes118

  • Size

    92KB

  • MD5

    f946210397491f2bccc1afa83e76801d

  • SHA1

    9f2f7f36161abedcd2b456065e8ac925f12554ee

  • SHA256

    fc0fc078830b699d2d9275612d62a273f85058d52db6e5e34304bc648bf791ef

  • SHA512

    c819a0e45eb7e986a3c0b9d749bc10f6d5e017bdc815691ef10ccb19b5b9a3bb6bff1a1d8cc28216856015046673c928a53c24405072e8e1c2c50699c83eda2b

  • SSDEEP

    1536:V8GcqcTmqTtwNfX57+ITRzkeSneWOeMjnTxMJzPO9aqs1TvNEUXfkzmPtG8x:SXTex9TRzkeSR3M7MPO93KEyfPt

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://116.122.158.195:8080/forum/viewtopic.php

http://siteseoguide.com:8080/forum/viewtopic.php

http://uksonlinedating.com:8080/forum/viewtopic.php

http://199.59.56.105:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://www.connecticutvahomeloans.com/nmPVq.exe

    http://penneshop.com/jTZZ1c.exe

    http://www.fichtenflitzer.de/QX5.exe

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f946210397491f2bccc1afa83e76801d_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    8ccde584db2b33df6901142bba965604


    Headers

    Imports

    Sections