Overview

overview

10

Static

static

1

787acfc593...18.exe

windows7-x64

10

787acfc593...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    787acfc59392b39dff7af52cf823267d_JaffaCakes118

  • Size

    185KB

  • Sample

    241028-jh5ktsteqd

  • MD5

    787acfc59392b39dff7af52cf823267d

  • SHA1

    29b52e2592f1b1bdb001db0bafdc0b20b33b2803

  • SHA256

    ee9491900653d41aff2a85e005102d25f566ba27103523d4386bbf67b2c81519

  • SHA512

    7b30553557c2aabd32fd4811829f7a499599610b9c00cbb2930c3a49e35bbed921bc18792eaa3aa97a0b6b45ba014028dc19f4df11b7952d3dcdef860b009cf0

  • SSDEEP

    3072:fz6LrCRg0lOlOkNeP3SdHfvzLlbgED1QRjjZ5wCLqfV:fznn2NC3wvzd9DGnZLqt

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.LOMERDASTER.NET/ponyz/gate.php

http://13.ZABAKARVESTER.NET/ponyz/gate.php

http://66.228.61.192/ponyz/gate.php

http://173.246.103.26/ponyz/gate.php
Attributes
  • payload_url

    http://smileonkids.com/p2qUegs.exe

    http://www.speakintmob.co.uk/sGr1x.exe

    http://ftp.ibuss-allan.com/VWSos8F.exe

Targets

    • Target

      787acfc59392b39dff7af52cf823267d_JaffaCakes118

    • Size

      185KB

    • MD5

      787acfc59392b39dff7af52cf823267d

    • SHA1

      29b52e2592f1b1bdb001db0bafdc0b20b33b2803

    • SHA256

      ee9491900653d41aff2a85e005102d25f566ba27103523d4386bbf67b2c81519

    • SHA512

      7b30553557c2aabd32fd4811829f7a499599610b9c00cbb2930c3a49e35bbed921bc18792eaa3aa97a0b6b45ba014028dc19f4df11b7952d3dcdef860b009cf0

    • SSDEEP

      3072:fz6LrCRg0lOlOkNeP3SdHfvzLlbgED1QRjjZ5wCLqfV:fznn2NC3wvzd9DGnZLqt

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks