General

  • Target

    e47dbbb9e611c33243ec06a6d33fa090_JaffaCakes118

  • Size

    95KB

  • Sample

    241212-d2krwayqby

  • MD5

    e47dbbb9e611c33243ec06a6d33fa090

  • SHA1

    7b3f7d94c1e8f90dc7ac33856ab0a8b3bdb8991d

  • SHA256

    abcdc06115fb9be083361281ffe5d3881eaa341cc0a497f78b6ad3fb7a966de8

  • SHA512

    e0b66f12abfa7eff991eabe4a4b2661dd28f49612111e60d74cbc2f71fda73cc18b1c2ddc7c0a078e92a4f2b0c91d3dc8e069893aa8f98a32ff9850805a9c829

  • SSDEEP

    1536:cak21uU8w4tf7vTM1/qhayNh7Oreihjs/6IZiQo+oK56NMQKnbZo2+jOVfM8WF5V:WBw4FvOTSOreihP3BFY9oJxZFPd

Malware Config

Extracted

Family

pony

C2

http://kydshey.pw:4915/way/like.php

http://lktyids.pw:4915/way/like.php

Targets

    • Target

      e47dbbb9e611c33243ec06a6d33fa090_JaffaCakes118

    • Size

      95KB

    • MD5

      e47dbbb9e611c33243ec06a6d33fa090

    • SHA1

      7b3f7d94c1e8f90dc7ac33856ab0a8b3bdb8991d

    • SHA256

      abcdc06115fb9be083361281ffe5d3881eaa341cc0a497f78b6ad3fb7a966de8

    • SHA512

      e0b66f12abfa7eff991eabe4a4b2661dd28f49612111e60d74cbc2f71fda73cc18b1c2ddc7c0a078e92a4f2b0c91d3dc8e069893aa8f98a32ff9850805a9c829

    • SSDEEP

      1536:cak21uU8w4tf7vTM1/qhayNh7Oreihjs/6IZiQo+oK56NMQKnbZo2+jOVfM8WF5V:WBw4FvOTSOreihP3BFY9oJxZFPd

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks