Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60fd1fe579b1e5a97381563eed708690

  • Size

    133KB

  • Sample

    250101-197myazncn

  • MD5

    60fd1fe579b1e5a97381563eed708690

  • SHA1

    f931e39b1a6e90942005a3ef6f750ff31b61acdd

  • SHA256

    4ebdc06031a6d18034a3ad73d098dd2e8d029d13bcb615d7d92c72d031e1fbe6

  • SHA512

    7b190528e40e7687a17636aca05873d112eb89d25bd322482fe5a87c98c879c94755a0122b4083030d33ef90b0e7a40427c072c53b134593488941e276b1a56e

  • SSDEEP

    3072:HcL0q1s2/0z0YMpxm5ZLG36Rc6aSuX2uBopgt9Jt5:IG24L8xm5ZLA626eXZBAg9D

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://mail.yaklasim.com:8080/ponyb/gate.php

http://116.122.158.195:8080/ponyb/gate.php

http://moonstire.com/ponyb/gate.php

http://natestire.com/ponyb/gate.php
Attributes
  • payload_url

    http://1494ccc706155932.lolipop.jp/cy3hL.exe

    http://000023p.rcomhost.com/FkK.exe

    http://arepix.cz/hHfcdusL.exe

    http://0000bkb.rcomhost.com/gp6X.exe

Targets

    • Target

      JaffaCakes118_60fd1fe579b1e5a97381563eed708690

    • Size

      133KB

    • MD5

      60fd1fe579b1e5a97381563eed708690

    • SHA1

      f931e39b1a6e90942005a3ef6f750ff31b61acdd

    • SHA256

      4ebdc06031a6d18034a3ad73d098dd2e8d029d13bcb615d7d92c72d031e1fbe6

    • SHA512

      7b190528e40e7687a17636aca05873d112eb89d25bd322482fe5a87c98c879c94755a0122b4083030d33ef90b0e7a40427c072c53b134593488941e276b1a56e

    • SSDEEP

      3072:HcL0q1s2/0z0YMpxm5ZLG36Rc6aSuX2uBopgt9Jt5:IG24L8xm5ZLA626eXZBAg9D

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks