General

  • Target

    8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118

  • Size

    188KB

  • Sample

    241104-fq9b7stlez

  • MD5

    8f4ca7f02d146d6b76a5e7682f952492

  • SHA1

    0fa9a0484fe5cd2d294bec18ac2f97e7d08a3d85

  • SHA256

    2e18254948c11fd4e111bdb483459d630ea4f0234615b0b4c65db3a68b312690

  • SHA512

    d1f2d8346de708c3fc0fa23e4f493c02be6b6b7b456326280d975c90528084cf69dc9c77fd842871576634ad52abdc5147c9018bb46720188b423b96ba9f8262

  • SSDEEP

    3072:dM1Yv6deFRNfMZU3t+PW1+1W3v1QRbjTp8OVioCm:dMZUMq3D1+1Qvm9xVt

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/ponyb/gate.php

http://13.JONEMNOMINIK.NET/ponyb/gate.php

http://13.LOMERDASTER.NET/ponyb/gate.php

http://13.ZABAKARVESTER.NET/ponyb/gate.php

Attributes
  • payload_url

    http://www.ptci-md.org/gbQ2o1H.exe

    http://www.abn-capital.com/PfH.exe

    http://cancunie.com/v2km.exe

Targets

    • Target

      8f4ca7f02d146d6b76a5e7682f952492_JaffaCakes118

    • Size

      188KB

    • MD5

      8f4ca7f02d146d6b76a5e7682f952492

    • SHA1

      0fa9a0484fe5cd2d294bec18ac2f97e7d08a3d85

    • SHA256

      2e18254948c11fd4e111bdb483459d630ea4f0234615b0b4c65db3a68b312690

    • SHA512

      d1f2d8346de708c3fc0fa23e4f493c02be6b6b7b456326280d975c90528084cf69dc9c77fd842871576634ad52abdc5147c9018bb46720188b423b96ba9f8262

    • SSDEEP

      3072:dM1Yv6deFRNfMZU3t+PW1+1W3v1QRbjTp8OVioCm:dMZUMq3D1+1Qvm9xVt

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks