Overview

overview

10

Static

static

1

71b46901b5...18.exe

windows7-x64

10

71b46901b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71b46901b5cefae6e5c8b042c8f95b22_JaffaCakes118

  • Size

    188KB

  • Sample

    241024-brnpnsxhja

  • MD5

    71b46901b5cefae6e5c8b042c8f95b22

  • SHA1

    179cfecd65f27a1dbe13e797e499462d28497ced

  • SHA256

    1fb438b8a5c18e3b4093ae950998cb9f394b5a0ea6aa3afeaac625df74821f2f

  • SHA512

    7d003c39cc417bf8509d3d9fa9f5d5e298e65dbe8e949f36961aa2363147a3af8ffa97b05e867a4c9ed382e4ed8f7ba705a6b91d2a8f69e8bb4fc127d934553e

  • SSDEEP

    3072:Cup7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUEK:Cu8UMSsXY8nEt9cETEJ

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/ponyd/gate.php

http://13.JONEMNOMINIK.NET/ponyd/gate.php

http://13.LOMERDASTER.NET/ponyd/gate.php

http://13.ZABAKARVESTER.NET/ponyd/gate.php
Attributes
  • payload_url

    http://www.absolution.hu/1SeHj.exe

    http://exectechgroup.com/krwZW95g.exe

    http://www1.boonstra-verswaren.nl/PXh.exe

    http://ambiance-warande.nl/e8UjnpYn.exe

    http://www.rh-industrie.de/aEP2.exe

    http://167611.webhosting65.1blu.de/Gr4.exe

Targets

    • Target

      71b46901b5cefae6e5c8b042c8f95b22_JaffaCakes118

    • Size

      188KB

    • MD5

      71b46901b5cefae6e5c8b042c8f95b22

    • SHA1

      179cfecd65f27a1dbe13e797e499462d28497ced

    • SHA256

      1fb438b8a5c18e3b4093ae950998cb9f394b5a0ea6aa3afeaac625df74821f2f

    • SHA512

      7d003c39cc417bf8509d3d9fa9f5d5e298e65dbe8e949f36961aa2363147a3af8ffa97b05e867a4c9ed382e4ed8f7ba705a6b91d2a8f69e8bb4fc127d934553e

    • SSDEEP

      3072:Cup7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUEK:Cu8UMSsXY8nEt9cETEJ

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks