Overview

overview

10

Static

static

3

8b170a028d...18.exe

windows7-x64

10

8b170a028d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b170a028dd6ba63ef886f2691eb0ddb_JaffaCakes118

  • Size

    94KB

  • Sample

    241103-mwat6a1pcz

  • MD5

    8b170a028dd6ba63ef886f2691eb0ddb

  • SHA1

    c3017e4dce8c3c8143b7a2aaf4c03eeda4effad3

  • SHA256

    60705214dd68f3bfc78578ae2cf035da9d32d14ec235eb06f416ee89822d3284

  • SHA512

    2c077f1b4722cfcee025505aa4cd2b40cf9e7084d34cef408ba567d224bb5f5f4174420e101a0918360662d7c8308603c550e7ca662f8ad099a37dd86d6a8d23

  • SSDEEP

    1536:8En0Uzj48lxjQQMszzF/WenVS+V29MHrFVp67Lv16kAh9XEST83me81eKBEFSN:qA3lxjQQMezF+eVS+2arZcv1HK9XESTB

Score
10/10
ponycredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://85.214.243.87:8080/pony/gate.php

http://88.85.99.44:8080/pony/gate.php

http://91.121.140.103:8080/pony/gate.php
Attributes
  • payload_url

    http://moveonmobile.com/AwKULeEx.exe

    http://www.bomcreto.com.br/sWt7gc5m.exe

    http://hellenic-antiaging-academy.gr/2wY.exe

    http://www.chapliniana.com/YCjPqL.exe

Targets

    • Target

      8b170a028dd6ba63ef886f2691eb0ddb_JaffaCakes118

    • Size

      94KB

    • MD5

      8b170a028dd6ba63ef886f2691eb0ddb

    • SHA1

      c3017e4dce8c3c8143b7a2aaf4c03eeda4effad3

    • SHA256

      60705214dd68f3bfc78578ae2cf035da9d32d14ec235eb06f416ee89822d3284

    • SHA512

      2c077f1b4722cfcee025505aa4cd2b40cf9e7084d34cef408ba567d224bb5f5f4174420e101a0918360662d7c8308603c550e7ca662f8ad099a37dd86d6a8d23

    • SSDEEP

      1536:8En0Uzj48lxjQQMszzF/WenVS+V29MHrFVp67Lv16kAh9XEST83me81eKBEFSN:qA3lxjQQMezF+eVS+2arZcv1HK9XESTB

    Score
    10/10
    ponycredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks