General

  • Target

    ad409538ed06bb632044e4cf710888e0_JaffaCakes118

  • Size

    118KB

  • Sample

    241128-xfjggawncz

  • MD5

    ad409538ed06bb632044e4cf710888e0

  • SHA1

    305bf9f235b4f1056af6d610ffb0d7e054ac769e

  • SHA256

    87825ec185a1214353d32745bac41f91ba96f4c773473612d01c5123056d9c23

  • SHA512

    2b223983e0a5f72bf71080d622af611ee41ee49f088b875c548d741cf45f28bd1d0f043bc4c4b1c0337634672bc0f18a5933666a889f1116ff061aa2caca083a

  • SSDEEP

    1536:mWQ/GFgGVuCHIlvcffrrK9uUicpfOY+1JymDjKm9WLGQ5dXlJDDDzW/ok5rH+1N0:QGVuSYqra9MY+tHKb/FJDDDzW/Xe1N0

Malware Config

Extracted

Family

pony

C2

http://webmail.alsultantravel.com:8080/forum/viewtopic.php

http://alsultantravel.com:8080/forum/viewtopic.php

http://webmail.alsultantravel.info:8080/forum/viewtopic.php

http://198.57.130.35:8080/forum/viewtopic.php

Attributes
  • payload_url

    http://legodendart.com/f2kr.exe

    http://horizon.okcareertech.org/1k7Yvm.exe

    http://marinapanagiotidou.gr/qntUYid.exe

    http://www.sch.ac.cy/DH8xSJxy.exe

Targets

    • Target

      ad409538ed06bb632044e4cf710888e0_JaffaCakes118

    • Size

      118KB

    • MD5

      ad409538ed06bb632044e4cf710888e0

    • SHA1

      305bf9f235b4f1056af6d610ffb0d7e054ac769e

    • SHA256

      87825ec185a1214353d32745bac41f91ba96f4c773473612d01c5123056d9c23

    • SHA512

      2b223983e0a5f72bf71080d622af611ee41ee49f088b875c548d741cf45f28bd1d0f043bc4c4b1c0337634672bc0f18a5933666a889f1116ff061aa2caca083a

    • SSDEEP

      1536:mWQ/GFgGVuCHIlvcffrrK9uUicpfOY+1JymDjKm9WLGQ5dXlJDDDzW/ok5rH+1N0:QGVuSYqra9MY+tHKb/FJDDDzW/Xe1N0

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks