Overview

overview

10

Static

static

1

54aea89080...18.exe

windows7-x64

10

54aea89080...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    54aea8908046d14a91129ffacbd6c747_JaffaCakes118

  • Size

    91KB

  • Sample

    241018-bn23wsxfrc

  • MD5

    54aea8908046d14a91129ffacbd6c747

  • SHA1

    594a166b926f6cbbf369bfd9b2328075612e7b1d

  • SHA256

    94da874d00c63636ec466be6bf682b26026a951f02c61b22b23f4e14b6a17e75

  • SHA512

    91fee43f91b7781ddd0107ce3792293df164233974dde9cbb05ab46ed72fb86900ce3b7c8c5f8b1b5122ffdea223c565e16265b57c92fd3f75370f9a840fa221

  • SSDEEP

    1536:ctvfR5pkFf34WoZh1Oxu1GRnrdV2RZF7ph8TKbUXpQVNnHrKjgW8zrFIU4DgInQN:cth5prj1+1GnphEKb8CgcPp8QN

Score
10/10
ponycredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://www.alberghi.com:8080/pony/gate.php

http://zelia.net:8080/pony/gate.php
Attributes
  • payload_url

    http://safamobilya.com/VyBxtBiT/m1KBUJXC.exe

    http://www.biroform.com.mk/vibBmja6/fc0nJ.exe

    http://www.z-bid-z.com/1Ypg1X1N/ZMSQW.exe

Targets

    • Target

      54aea8908046d14a91129ffacbd6c747_JaffaCakes118

    • Size

      91KB

    • MD5

      54aea8908046d14a91129ffacbd6c747

    • SHA1

      594a166b926f6cbbf369bfd9b2328075612e7b1d

    • SHA256

      94da874d00c63636ec466be6bf682b26026a951f02c61b22b23f4e14b6a17e75

    • SHA512

      91fee43f91b7781ddd0107ce3792293df164233974dde9cbb05ab46ed72fb86900ce3b7c8c5f8b1b5122ffdea223c565e16265b57c92fd3f75370f9a840fa221

    • SSDEEP

      1536:ctvfR5pkFf34WoZh1Oxu1GRnrdV2RZF7ph8TKbUXpQVNnHrKjgW8zrFIU4DgInQN:cth5prj1+1GnphEKb8CgcPp8QN

    Score
    10/10
    ponycredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks