Overview

overview

10

Static

static

1

fa25a8348c...18.exe

windows7-x64

10

fa25a8348c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa25a8348c187661b31f997c4fca7c75_JaffaCakes118

  • Size

    188KB

  • Sample

    241218-fdf5wstmav

  • MD5

    fa25a8348c187661b31f997c4fca7c75

  • SHA1

    7d011443a9175b1cc98d2c2534fb0c016fe97ea1

  • SHA256

    87d6bd700610cc909298f96692492b4c10a095994a687b3bbaf27431e8b146b6

  • SHA512

    bd97828e967f70922ae00c6e0421d6a0f2c2b39d101877508959479f7832499b1c0eadf8aa5e3490ff59fb493829f77324fa81f9bca77fc42d27897f795908be

  • SSDEEP

    3072:SjVp7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUUi:C8UMSsXY8nEt9cETEx

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/ponyd/gate.php

http://13.JONEMNOMINIK.NET/ponyd/gate.php

http://13.LOMERDASTER.NET/ponyd/gate.php

http://13.ZABAKARVESTER.NET/ponyd/gate.php
Attributes
  • payload_url

    http://www.absolution.hu/1SeHj.exe

    http://exectechgroup.com/krwZW95g.exe

    http://www1.boonstra-verswaren.nl/PXh.exe

    http://ambiance-warande.nl/e8UjnpYn.exe

    http://www.rh-industrie.de/aEP2.exe

    http://167611.webhosting65.1blu.de/Gr4.exe

Targets

    • Target

      fa25a8348c187661b31f997c4fca7c75_JaffaCakes118

    • Size

      188KB

    • MD5

      fa25a8348c187661b31f997c4fca7c75

    • SHA1

      7d011443a9175b1cc98d2c2534fb0c016fe97ea1

    • SHA256

      87d6bd700610cc909298f96692492b4c10a095994a687b3bbaf27431e8b146b6

    • SHA512

      bd97828e967f70922ae00c6e0421d6a0f2c2b39d101877508959479f7832499b1c0eadf8aa5e3490ff59fb493829f77324fa81f9bca77fc42d27897f795908be

    • SSDEEP

      3072:SjVp7nmwfvrmQzySsaeYd2rVnEfVtLc1QjtjtuWGWBUUi:C8UMSsXY8nEt9cETEx

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks