General

  • Target

    aece7d37bb0f1535752f662b278735fc_JaffaCakes118

  • Size

    159KB

  • Sample

    241129-eqtfbavkdv

  • MD5

    aece7d37bb0f1535752f662b278735fc

  • SHA1

    d61b64f3fa0105b4e82b82ebca695fbc6c75b504

  • SHA256

    f5d61301c32a500b9a46507167628df7c2281003accd894d98c5132779a4a22f

  • SHA512

    bd933a54129eed95d81f3217284b9c5248a1b59d6f4a64266d14358d48e56a66fd6d2416a6948ed315f88d82f370142ad8aec247d632d52833d8b8b094b85fe3

  • SSDEEP

    1536:9+Jb1ltgkxFWzlVUfieYxjLfkrreR0EqLTySQINtcABzuh/Cz60jjCE7Zk5wuKcF:elOkryleYJ50E+yS/u50H9juKcF

Malware Config

Extracted

Family

pony

C2

http://ks384721.kimsufi.com:81/pony/gate.php

http://72.37.220.10:8080/pony/gate.php

Attributes
  • payload_url

    http://talentquest.com.mx/1MPj.exe

    http://eqsync.com/48QUMsb.exe

    http://apostagol1.web102.f1.k8.com.br/782V.exe

Targets

    • Target

      aece7d37bb0f1535752f662b278735fc_JaffaCakes118

    • Size

      159KB

    • MD5

      aece7d37bb0f1535752f662b278735fc

    • SHA1

      d61b64f3fa0105b4e82b82ebca695fbc6c75b504

    • SHA256

      f5d61301c32a500b9a46507167628df7c2281003accd894d98c5132779a4a22f

    • SHA512

      bd933a54129eed95d81f3217284b9c5248a1b59d6f4a64266d14358d48e56a66fd6d2416a6948ed315f88d82f370142ad8aec247d632d52833d8b8b094b85fe3

    • SSDEEP

      1536:9+Jb1ltgkxFWzlVUfieYxjLfkrreR0EqLTySQINtcABzuh/Cz60jjCE7Zk5wuKcF:elOkryleYJ50E+yS/u50H9juKcF

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks