Overview

overview

10

Static

static

3

135a448f1b...18.exe

windows7-x64

10

135a448f1b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    135a448f1b926768cf1d0308903a3b54_JaffaCakes118

  • Size

    133KB

  • Sample

    241004-plkmqaxhpc

  • MD5

    135a448f1b926768cf1d0308903a3b54

  • SHA1

    745892afc58bb2ca8efbb8d1620e550e4c2e35a7

  • SHA256

    19c0859a4f0041632b5cbd838404331f47edd1acec4a5467023f5f4fd0975252

  • SHA512

    63728ea7c3893a1228a5b605f278636ab19f2020e3afb1b8aa7f43785acfc4ec25c5e632c883b8f477acac65db09189a199a036d40797715f36f7a67ca68a86c

  • SSDEEP

    3072:QyW4R/iRVS073a5PdOlqQg2sb6Stn8R7rqZvrs:Q6R/WdaAAZtnO7YTs

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://capitulosde.com:8080/forum/viewtopic.php

http://168.144.38.105:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://mybandtv.de/dDbd9xgx.exe

    http://www.outsourcingservicesusa.com/hq1Hjn9C.exe

    http://actualidadliberal.es/mDZGqH.exe

    http://www.collectors-fair.co.uk/dMmztkT.exe

    http://progralmedical.com.co/DBya.exe

    http://askdrthomas.com/NTkDaN.exe

    http://dineromultiple.com/wdgBe.exe

    http://weavervillemassage.com/zWNA4.exe

Targets

    • Target

      135a448f1b926768cf1d0308903a3b54_JaffaCakes118

    • Size

      133KB

    • MD5

      135a448f1b926768cf1d0308903a3b54

    • SHA1

      745892afc58bb2ca8efbb8d1620e550e4c2e35a7

    • SHA256

      19c0859a4f0041632b5cbd838404331f47edd1acec4a5467023f5f4fd0975252

    • SHA512

      63728ea7c3893a1228a5b605f278636ab19f2020e3afb1b8aa7f43785acfc4ec25c5e632c883b8f477acac65db09189a199a036d40797715f36f7a67ca68a86c

    • SSDEEP

      3072:QyW4R/iRVS073a5PdOlqQg2sb6Stn8R7rqZvrs:Q6R/WdaAAZtnO7YTs

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks