Overview

overview

10

Static

static

1

3c75cbef3c...18.exe

windows7-x64

10

3c75cbef3c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c75cbef3c3a1013ee1a3645c105c28e_JaffaCakes118

  • Size

    188KB

  • Sample

    241012-2wjvdszflr

  • MD5

    3c75cbef3c3a1013ee1a3645c105c28e

  • SHA1

    1278caa37db66bc5b6e645f3908dd0ae3b1d04dc

  • SHA256

    19be10dde7f6b47de8e5f987a8d56ce2da197fc36cfe4d154553ab81e6783eb3

  • SHA512

    f2fb613de38fd1cd26ce43ae08a4e4d583c223260bbd2097c7691522750967ba10640e482ff1bafea7a5ddeb12c5d7a4b91b82afad54492a2fb218b0dc811ea0

  • SSDEEP

    3072:c5p7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUEj:c58UMSsXY8nEt9cETEc

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/ponyd/gate.php

http://13.JONEMNOMINIK.NET/ponyd/gate.php

http://13.LOMERDASTER.NET/ponyd/gate.php

http://13.ZABAKARVESTER.NET/ponyd/gate.php
Attributes
  • payload_url

    http://www.absolution.hu/1SeHj.exe

    http://exectechgroup.com/krwZW95g.exe

    http://www1.boonstra-verswaren.nl/PXh.exe

    http://ambiance-warande.nl/e8UjnpYn.exe

    http://www.rh-industrie.de/aEP2.exe

    http://167611.webhosting65.1blu.de/Gr4.exe

Targets

    • Target

      3c75cbef3c3a1013ee1a3645c105c28e_JaffaCakes118

    • Size

      188KB

    • MD5

      3c75cbef3c3a1013ee1a3645c105c28e

    • SHA1

      1278caa37db66bc5b6e645f3908dd0ae3b1d04dc

    • SHA256

      19be10dde7f6b47de8e5f987a8d56ce2da197fc36cfe4d154553ab81e6783eb3

    • SHA512

      f2fb613de38fd1cd26ce43ae08a4e4d583c223260bbd2097c7691522750967ba10640e482ff1bafea7a5ddeb12c5d7a4b91b82afad54492a2fb218b0dc811ea0

    • SSDEEP

      3072:c5p7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUEj:c58UMSsXY8nEt9cETEc

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks