Overview

overview

10

Static

static

3

488a1cd582...18.exe

windows7-x64

10

488a1cd582...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    488a1cd58258d1490a872e4913d77f96_JaffaCakes118

  • Size

    109KB

  • Sample

    241015-spfpqawaqj

  • MD5

    488a1cd58258d1490a872e4913d77f96

  • SHA1

    985b96125d50eaa09c1ba315e8a49d6877cab335

  • SHA256

    2da11b31550df4ff9cffb6ff6373257f9fa3c35b3efb0811d0f5f5e78907fb24

  • SHA512

    10bc8e6dd85a024456329248ce06761dc500ca0d663b01b0a562705d046cd607b772b552c4354d75938e64e63dfbf5d2daf047e0b8c146e070e1fcf9bf67f9f8

  • SSDEEP

    3072:RBjSwT37RZkxQL+C/xCzVuhK39c3zPtJum2dH:32U75aOxCzocc32Dd

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://watch-fp.us/forum/viewtopic.php

http://watchfp.biz/forum/viewtopic.php

http://watchfp.ca/forum/viewtopic.php

http://watchfp.info/forum/viewtopic.php
Attributes
  • payload_url

    http://imagesuperspot.com/6ptP.exe

    http://1954f7e942e67bc1.lolipop.jp/d2z.exe

    http://aasthakitchen.com/mjSs.exe

    http://colombiantravelservices.com/ucUMruv.exe

Targets

    • Target

      488a1cd58258d1490a872e4913d77f96_JaffaCakes118

    • Size

      109KB

    • MD5

      488a1cd58258d1490a872e4913d77f96

    • SHA1

      985b96125d50eaa09c1ba315e8a49d6877cab335

    • SHA256

      2da11b31550df4ff9cffb6ff6373257f9fa3c35b3efb0811d0f5f5e78907fb24

    • SHA512

      10bc8e6dd85a024456329248ce06761dc500ca0d663b01b0a562705d046cd607b772b552c4354d75938e64e63dfbf5d2daf047e0b8c146e070e1fcf9bf67f9f8

    • SSDEEP

      3072:RBjSwT37RZkxQL+C/xCzVuhK39c3zPtJum2dH:32U75aOxCzocc32Dd

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks