Overview

overview

10

Static

static

1

d84fd8df82...18.exe

windows7-x64

10

d84fd8df82...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d84fd8df82dea5b9bc436e45e8c7d6d8_JaffaCakes118

  • Size

    146KB

  • Sample

    241208-wlz6qs1lev

  • MD5

    d84fd8df82dea5b9bc436e45e8c7d6d8

  • SHA1

    e73d4f64e5170ca02a336a58aa8091be9621f7ea

  • SHA256

    c314afd09f1994fe878fed45b065dbafd636d1a8960f40cbfcf34a6195dabc19

  • SHA512

    b2c81d38b4259ab83a2fc8649468a07ec2645e70b24c37599304da98474e9a0f83083c5cce76957c5173335091fe12ce52b7f7d6ce18cb8b1a48dc0caca94fd1

  • SSDEEP

    3072:70qgtsRE3QYQgjijpTlc8FveyoBqwEayql62O:YQRE3QjuidTbhehEzq62O

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://2.sardiniaexport.com/forum/viewtopic.php

http://2.enzofavata.com/forum/viewtopic.php
Attributes
  • payload_url

    http://mjorart.com/jTc.exe

    http://bestinsighttours.com/bZ6.exe

    http://rdquark.com/cAB.exe

    http://quranaqiq.com/1kH.exe

    http://www.westquimica.com/AuNP5.exe

    http://reymontstore.com/jJW5.exe

    http://powergames.com.pt/KVG.exe

    http://www.rcrender.com/47NK.exe

    http://staugustineblues.com/n8cZZi.exe

Targets

    • Target

      d84fd8df82dea5b9bc436e45e8c7d6d8_JaffaCakes118

    • Size

      146KB

    • MD5

      d84fd8df82dea5b9bc436e45e8c7d6d8

    • SHA1

      e73d4f64e5170ca02a336a58aa8091be9621f7ea

    • SHA256

      c314afd09f1994fe878fed45b065dbafd636d1a8960f40cbfcf34a6195dabc19

    • SHA512

      b2c81d38b4259ab83a2fc8649468a07ec2645e70b24c37599304da98474e9a0f83083c5cce76957c5173335091fe12ce52b7f7d6ce18cb8b1a48dc0caca94fd1

    • SSDEEP

      3072:70qgtsRE3QYQgjijpTlc8FveyoBqwEayql62O:YQRE3QjuidTbhehEzq62O

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks