General

  • Target

    43b86ada72e178fae04ae847c03948d5_JaffaCakes118

  • Size

    190KB

  • Sample

    241014-xpf3ps1crf

  • MD5

    43b86ada72e178fae04ae847c03948d5

  • SHA1

    16053546d522ce37fbaba1de55a8c98fe68edba3

  • SHA256

    3bec51e9bacbe530bfe087a3f8b94aa3b71e9c3840da5756f788d1b50b89f674

  • SHA512

    8fb2e4f55bee68defc869c28e5e3f47c3c05f2791075e8320143ae6ff42796492c3abb332e3db76a0cb6664631417691d5cb93cb6ca123229d45ac7bbd70c2c5

  • SSDEEP

    3072:wLfAbt1dj2pDE6JHvr48gBs+Zaupb3coCeo930ZEj:wLmXqLJPr48g/Zot1

Malware Config

Extracted

Family

pony

C2

http://classicmodels.at:8080/forum/viewtopic.php

http://diva-code.at:8080/forum/viewtopic.php

Attributes
  • payload_url

    http://www.welatec.ch/3K8T5Hu.exe

    http://www.acibr.org.br/PATgKq.exe

    http://cloudfast.com.br/tjV.exe

Targets

    • Target

      43b86ada72e178fae04ae847c03948d5_JaffaCakes118

    • Size

      190KB

    • MD5

      43b86ada72e178fae04ae847c03948d5

    • SHA1

      16053546d522ce37fbaba1de55a8c98fe68edba3

    • SHA256

      3bec51e9bacbe530bfe087a3f8b94aa3b71e9c3840da5756f788d1b50b89f674

    • SHA512

      8fb2e4f55bee68defc869c28e5e3f47c3c05f2791075e8320143ae6ff42796492c3abb332e3db76a0cb6664631417691d5cb93cb6ca123229d45ac7bbd70c2c5

    • SSDEEP

      3072:wLfAbt1dj2pDE6JHvr48gBs+Zaupb3coCeo930ZEj:wLmXqLJPr48g/Zot1

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks