Overview

overview

10

Static

static

1

a2e833e5f0...18.exe

windows7-x64

10

a2e833e5f0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2e833e5f00ddda623e67a80368246e6_JaffaCakes118

  • Size

    188KB

  • Sample

    241126-tn61ysvmgl

  • MD5

    a2e833e5f00ddda623e67a80368246e6

  • SHA1

    53ebfcec155696f5dbf30ea97ad6e163d45ed550

  • SHA256

    a494deddee031b2aa02cec091c25ecac7d427b07dd339ee69f823e862ac92748

  • SHA512

    176769c2993748f812ec48ca75bc7b1b6f21cd664e59160826dfb313fa79e80a16390e1e2cf1dfd8923295deb89050393b4bad6c3f6658cfce5a78fa30d0c617

  • SSDEEP

    3072:DzSnehmdZlRlEeIDFewuSVAc5yah0W/r1QRnjWiTSb+:ivODAwuQwahnDmaiTl

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/forum/viewtopic.php

http://13.JONEMNOMINIK.NET/forum/viewtopic.php

http://13.LOMERDASTER.NET/forum/viewtopic.php

http://13.ZABAKARVESTER.NET/forum/viewtopic.php
Attributes
  • payload_url

    http://carmodyminefreight.com.au/ekDudxZy/G8F2KMPS.exe

    http://173.192.39.2/dCCJ1QK8/7o3Kj4F.exe

    http://www.asteriskocomunicazione.it/ZbwBgeHf/mAtqwC.exe

Targets

    • Target

      a2e833e5f00ddda623e67a80368246e6_JaffaCakes118

    • Size

      188KB

    • MD5

      a2e833e5f00ddda623e67a80368246e6

    • SHA1

      53ebfcec155696f5dbf30ea97ad6e163d45ed550

    • SHA256

      a494deddee031b2aa02cec091c25ecac7d427b07dd339ee69f823e862ac92748

    • SHA512

      176769c2993748f812ec48ca75bc7b1b6f21cd664e59160826dfb313fa79e80a16390e1e2cf1dfd8923295deb89050393b4bad6c3f6658cfce5a78fa30d0c617

    • SSDEEP

      3072:DzSnehmdZlRlEeIDFewuSVAc5yah0W/r1QRnjWiTSb+:ivODAwuQwahnDmaiTl

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks