Overview

overview

10

Static

static

3

006ee74b6e...18.exe

windows7-x64

10

006ee74b6e...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    006ee74b6e093948d906d080ad4b6340_JaffaCakes118

  • Size

    122KB

  • Sample

    240930-klyr5awapk

  • MD5

    006ee74b6e093948d906d080ad4b6340

  • SHA1

    0e3aa3e9f6108ed73b41e618a98582194c0dd15e

  • SHA256

    324b1e101113481e0cff00a19ab33252b01c77e68c69e4729d5a366b99dab815

  • SHA512

    ef92c4658db6f03805df69481658c456ec49177d59de38c0bd2b26b1a4f48274d8fcf82cbde0496bf8b5b28d30de6448bac96d71f4e455f30547ffffaee99a42

  • SSDEEP

    3072:eg9FQAs8AMJNSjsHgCItEbkXAAO41BIFHdt6tXNS5:+AsgNuIHItE4XAO1B6H4XN

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://www.arki.com:8080/ponys/gate.php

http://arki.com:8080/ponys/gate.php

http://50.57.185.72:8080/ponys/gate.php

http://frccc.com/ponys/gate.php
Attributes
  • payload_url

    http://communication.promos-auto.com/jFu.exe

    http://plugwise.gr/UoZxBi8J.exe

    http://integrityworldwide.co.uk/DVpCH.exe

    http://ca-merchant.com/gGECP57.exe

Targets

    • Target

      006ee74b6e093948d906d080ad4b6340_JaffaCakes118

    • Size

      122KB

    • MD5

      006ee74b6e093948d906d080ad4b6340

    • SHA1

      0e3aa3e9f6108ed73b41e618a98582194c0dd15e

    • SHA256

      324b1e101113481e0cff00a19ab33252b01c77e68c69e4729d5a366b99dab815

    • SHA512

      ef92c4658db6f03805df69481658c456ec49177d59de38c0bd2b26b1a4f48274d8fcf82cbde0496bf8b5b28d30de6448bac96d71f4e455f30547ffffaee99a42

    • SSDEEP

      3072:eg9FQAs8AMJNSjsHgCItEbkXAAO41BIFHdt6tXNS5:+AsgNuIHItE4XAO1B6H4XN

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks