Overview

overview

10

Static

static

3

aaa506a1d2...18.exe

windows7-x64

10

aaa506a1d2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aaa506a1d2084e0fb6159f1e8b84907b_JaffaCakes118

  • Size

    158KB

  • Sample

    241128-cy9q6axmhj

  • MD5

    aaa506a1d2084e0fb6159f1e8b84907b

  • SHA1

    c4f7cb3bd34ae227265e48f2be39be87fbb41693

  • SHA256

    7f28889af147833d07984424552c2a5552c2853ef4cfbcce7204c22205ea5f48

  • SHA512

    28f12a0e7ea6e4247927191b9c982d5b82eca9eba73305dfe1fee117dc86e7eb4e829fde6be72df13b48c0e6d97868525010530ed02e4c411ced9cfdb926787e

  • SSDEEP

    3072:q3jl0ceWFhzNbq+ji+KpTvM0mfNJJSpk1tjiFkRcOYnlZW:qTl0ceWHzNe+jnKpg0mfJN1t

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://bigfishllc.com:81/ponyb/gate.php

http://3ecompany.com:8080/ponyb/gate.php

http://24.coloradowoundcare.com/ponyb/gate.php

http://24.cuttingedgemeeth.com/ponyb/gate.php
Attributes
  • payload_url

    http://bigdollarbills.com/sF2jEhs.exe

    http://palsoq.com/7M73R.exe

    http://vouwtje.nl.webhosting20.transurl.nl/g7je.exe

Targets

    • Target

      aaa506a1d2084e0fb6159f1e8b84907b_JaffaCakes118

    • Size

      158KB

    • MD5

      aaa506a1d2084e0fb6159f1e8b84907b

    • SHA1

      c4f7cb3bd34ae227265e48f2be39be87fbb41693

    • SHA256

      7f28889af147833d07984424552c2a5552c2853ef4cfbcce7204c22205ea5f48

    • SHA512

      28f12a0e7ea6e4247927191b9c982d5b82eca9eba73305dfe1fee117dc86e7eb4e829fde6be72df13b48c0e6d97868525010530ed02e4c411ced9cfdb926787e

    • SSDEEP

      3072:q3jl0ceWFhzNbq+ji+KpTvM0mfNJJSpk1tjiFkRcOYnlZW:qTl0ceWHzNe+jnKpg0mfJN1t

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks