Overview

overview

10

Static

static

3

3944c32e64...18.exe

windows7-x64

10

3944c32e64...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3944c32e646e002d58d3069ccb75b250_JaffaCakes118

  • Size

    114KB

  • Sample

    241012-k6hawatama

  • MD5

    3944c32e646e002d58d3069ccb75b250

  • SHA1

    c2e3b28b646acfd2f12699a0add6a96792250c9d

  • SHA256

    756e7c407a14f2096dcfcad495b9a51a3a3ba598e4460a0d534b2a427b493b6d

  • SHA512

    9951d735b36c2a473f7bdabf37da3647a42e9c0b5e234b143b255f5aad40cbc1aebe2337eba43b7bcb4ff5034f4197d821b69a9d6f85fcaf9e1773ffd48ccc06

  • SSDEEP

    3072:S9CgE/lRAaRFh5mnK0kOq50PjSdJwjphTXgpvXSA:YEFflOa0WvwdJgpq

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://customkids.com/forum/viewtopic.php

http://dharmaking.info/forum/viewtopic.php

http://dharmaking.net/forum/viewtopic.php

http://dharmaking.org/forum/viewtopic.php
Attributes
  • payload_url

    http://www.sheltiezuchtverein-deutschland-ev.de/bn43.exe

    http://ciclografico.pt/9Up.exe

    http://mdebra.o2switch.net/2ccVsM9z.exe

    http://speedupsoft.com/F67Kse.exe

Targets

    • Target

      3944c32e646e002d58d3069ccb75b250_JaffaCakes118

    • Size

      114KB

    • MD5

      3944c32e646e002d58d3069ccb75b250

    • SHA1

      c2e3b28b646acfd2f12699a0add6a96792250c9d

    • SHA256

      756e7c407a14f2096dcfcad495b9a51a3a3ba598e4460a0d534b2a427b493b6d

    • SHA512

      9951d735b36c2a473f7bdabf37da3647a42e9c0b5e234b143b255f5aad40cbc1aebe2337eba43b7bcb4ff5034f4197d821b69a9d6f85fcaf9e1773ffd48ccc06

    • SSDEEP

      3072:S9CgE/lRAaRFh5mnK0kOq50PjSdJwjphTXgpvXSA:YEFflOa0WvwdJgpq

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks