Overview

overview

10

Static

static

3

15fad4414c...18.exe

windows7-x64

10

15fad4414c...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15fad4414cbf900010e102976c55a7a0_JaffaCakes118

  • Size

    227KB

  • Sample

    241005-dzj3kaxbmc

  • MD5

    15fad4414cbf900010e102976c55a7a0

  • SHA1

    bfcbbd8b68b74f98bb79745ff01412789d7cd6df

  • SHA256

    80492abb6924a3baa8c0f8a58d211816c6917055b87ce6b8932c2020c673c60f

  • SHA512

    85f7acfe9927d46d91df64390936443cf7da1645526a5e597dd82faf2ad120ac7b4769679b28899f70d2b174433a9a3cf8bfd62ba9117fa7c0a2e4edfc24b51b

  • SSDEEP

    6144:91lE8umqehhwnNt+h5+stSQQHV3jz7pqWFkuK:91l1uJowG5vtSQWTJq+k

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://prestigecarstorage.com.au/wp-includes/Text/Text.php

http://mcmamina.cz/media/plg_quickicon_joomlaupdate/plg_quickicon_joomlaupdate.php

http://buyseoplan.com/wp-admin/includes/includes.php

http://letssaidiana.com/wp-admin/user/user.php

http://kenyadivas.com/media/editors/editors.php

http://keithgerchak.com/wp-admin/css/css.php

http://binarycashbackdaily.com/wp-admin/maint/maint.php

http://apexsitesolutions.com/main/wp-admin/mod_html.php

http://employerservice.net/wp-includes/theme-compat/theme-compat.php

http://hmb.com.au/wp-admin/images/images.php

http://denver-computer-repairs.com/wordpress2/wp-includes/fckeditor.php

http://hatmandoo.co.uk/cache/mod_menu/mod_menu.php

http://wizjafotografii.pl/wp-content/languages/languages.php

http://steve1der.com/wp-includes/css/css.php

http://elicense.studio98test.com/wp-content/themes/Action.php

http://resiteing.com/wp-content/ID3.php

http://mimembership.com/plugins/authentication/authentication.php

http://stephenvrichardson.com/wp-includes/css/css.php

http://mycasablancaflowers.com/wp-includes/js/js.php

http://staciriordan.com/wp-includes/images/images.php

Targets

    • Target

      15fad4414cbf900010e102976c55a7a0_JaffaCakes118

    • Size

      227KB

    • MD5

      15fad4414cbf900010e102976c55a7a0

    • SHA1

      bfcbbd8b68b74f98bb79745ff01412789d7cd6df

    • SHA256

      80492abb6924a3baa8c0f8a58d211816c6917055b87ce6b8932c2020c673c60f

    • SHA512

      85f7acfe9927d46d91df64390936443cf7da1645526a5e597dd82faf2ad120ac7b4769679b28899f70d2b174433a9a3cf8bfd62ba9117fa7c0a2e4edfc24b51b

    • SSDEEP

      6144:91lE8umqehhwnNt+h5+stSQQHV3jz7pqWFkuK:91l1uJowG5vtSQWTJq+k

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks