General

  • Target

    684b16d6e3f447b00998634cdecf804f_JaffaCakes118

  • Size

    159KB

  • Sample

    241022-byrd5s1cqq

  • MD5

    684b16d6e3f447b00998634cdecf804f

  • SHA1

    43433baf5548f4c706ac330dce657031140126ed

  • SHA256

    e86ccdf564325ed009d0ea39d12d235bbbee68d99d102e59c03170b135b8252e

  • SHA512

    9f9500a0ae6dcc0388f23b0f8ac755c146ed5b7dd26aa7fe3aa3cc68e342fa9cf2c4fee98659dfa728c41167e40d41437039613553086662b232c88be49c4e55

  • SSDEEP

    3072:LhFYJqjVylnaA+p5UriKVBPpNIO2Tb9qo69:LhHVeaTK7XI/i

Malware Config

Extracted

Family

pony

C2

http://etsiunjour.fr:81/pony/gate.php

http://akamaifilms.com:81/pony/gate.php

Attributes
  • payload_url

    http://galeriamz.com.br/PGH1K.exe

    http://www.maffeitur.com.br/D2J.exe

Targets

    • Target

      684b16d6e3f447b00998634cdecf804f_JaffaCakes118

    • Size

      159KB

    • MD5

      684b16d6e3f447b00998634cdecf804f

    • SHA1

      43433baf5548f4c706ac330dce657031140126ed

    • SHA256

      e86ccdf564325ed009d0ea39d12d235bbbee68d99d102e59c03170b135b8252e

    • SHA512

      9f9500a0ae6dcc0388f23b0f8ac755c146ed5b7dd26aa7fe3aa3cc68e342fa9cf2c4fee98659dfa728c41167e40d41437039613553086662b232c88be49c4e55

    • SSDEEP

      3072:LhFYJqjVylnaA+p5UriKVBPpNIO2Tb9qo69:LhHVeaTK7XI/i

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks