General
-
Target
fa5178d1862cf84074be47bd114bd021_JaffaCakes118
-
Size
188KB
-
Sample
241218-gcdh2swren
-
MD5
fa5178d1862cf84074be47bd114bd021
-
SHA1
f3ce01f3c396bada2d9dd117c0ecee6c3c335cdb
-
SHA256
193eddd223eb765d0474e3f17be4302acfa77fa673adcdf4f4e04e64e14327bd
-
SHA512
4b4c06d60007abe65fef1423cf12ad9fd06b4827627bf0228ff15f575f1aca0f676313cc4801c4b207c90763cf7e4277bc1702ee749e4a5a8c7373f3db1ceb82
-
SSDEEP
3072:GzUNEvCaehI/F0HnsFO1T+DEFJ1qO1QxijYMOM31nGVr:GzfB2Hss+EFJkOGmRA
Static task
static1
Behavioral task
behavioral1
Sample
fa5178d1862cf84074be47bd114bd021_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa5178d1862cf84074be47bd114bd021_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://13.carnovirious.net/ponyz/gate.php
http://13.JONEMNOMINIK.NET/ponyz/gate.php
http://13.LOMERDASTER.NET/ponyz/gate.php
http://13.ZABAKARVESTER.NET/ponyz/gate.php
-
payload_url
http://aquator.valmarkgroup.com/ge5L4WwL.exe
http://tdc-boelle.de/PcKwxH.exe
http://abbeyevents.co.uk/aegif.exe
Targets
-
-
Target
fa5178d1862cf84074be47bd114bd021_JaffaCakes118
-
Size
188KB
-
MD5
fa5178d1862cf84074be47bd114bd021
-
SHA1
f3ce01f3c396bada2d9dd117c0ecee6c3c335cdb
-
SHA256
193eddd223eb765d0474e3f17be4302acfa77fa673adcdf4f4e04e64e14327bd
-
SHA512
4b4c06d60007abe65fef1423cf12ad9fd06b4827627bf0228ff15f575f1aca0f676313cc4801c4b207c90763cf7e4277bc1702ee749e4a5a8c7373f3db1ceb82
-
SSDEEP
3072:GzUNEvCaehI/F0HnsFO1T+DEFJ1qO1QxijYMOM31nGVr:GzfB2Hss+EFJkOGmRA
-
Pony family
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-