Overview

overview

10

Static

static

3

b0d99d50a3...18.exe

windows7-x64

10

b0d99d50a3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0d99d50a36a88ae2093dcadea6d8330_JaffaCakes118

  • Size

    120KB

  • Sample

    241129-m9fybsxjhn

  • MD5

    b0d99d50a36a88ae2093dcadea6d8330

  • SHA1

    92f59dcad9781199a339a7160a63934d4221bd7e

  • SHA256

    a52df572680ed21657305c3746c0ba80fe7c391929c3c8b0ce66a3bf02da0412

  • SHA512

    25f84acef952f5827898e3e9e7be0d224319c6ea5659d4cd743aa7c93856b8cbbb90c572432ab65cccf3f8fee5d3b7ba69fdcdf4099628c4500a2310b8577983

  • SSDEEP

    1536:xXPIYcBbHPMch5aYKIsIm5JDbOpycVjtvCYQ8nRhBd4RCy8VHyU:f2xZm3OsstvC7khBd4RCtyU

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://203.113.98.131:8080/asp/intro.php

http://203.146.208.180:8080/asp/intro.php

http://42.121.116.38:8080/asp/intro.php

http://190.239.22.68:8080/asp/intro.php

http://202.164.211.51:8080/asp/intro.php

http://203.172.248.85:8080/asp/intro.php

http://195.24.205.188:8080/asp/intro.php

http://77.120.103.221:8080/asp/intro.php

http://111.68.142.223:8080/asp/intro.php

http://163.18.62.51:8080/asp/intro.php

Targets

    • Target

      b0d99d50a36a88ae2093dcadea6d8330_JaffaCakes118

    • Size

      120KB

    • MD5

      b0d99d50a36a88ae2093dcadea6d8330

    • SHA1

      92f59dcad9781199a339a7160a63934d4221bd7e

    • SHA256

      a52df572680ed21657305c3746c0ba80fe7c391929c3c8b0ce66a3bf02da0412

    • SHA512

      25f84acef952f5827898e3e9e7be0d224319c6ea5659d4cd743aa7c93856b8cbbb90c572432ab65cccf3f8fee5d3b7ba69fdcdf4099628c4500a2310b8577983

    • SSDEEP

      1536:xXPIYcBbHPMch5aYKIsIm5JDbOpycVjtvCYQ8nRhBd4RCy8VHyU:f2xZm3OsstvC7khBd4RCtyU

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks