Overview

overview

10

Static

static

3

JaffaCakes...00.exe

windows7-x64

10

JaffaCakes...00.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6120245ef7572b4021492e23e2c18000

  • Size

    117KB

  • Sample

    250101-2tv5ms1ndr

  • MD5

    6120245ef7572b4021492e23e2c18000

  • SHA1

    bd5b74df8c47da3f6b7631374be8a0d67d096a12

  • SHA256

    02e48eec2b659e428c7586dcdad68521a398e82d2a1110b99f5b2f2b12a11202

  • SHA512

    b432a346e68c9b62392763d8c24568b3232850a68798164b5dc1fe60f9d5bb79aae6685ba45a31a6529659960e3e9635da45944fec5cb5b78f8726ca31b29c2f

  • SSDEEP

    1536:uX8BEfVB9tu5O/8nwRY7zlxwBNZR8O+4gu2fx92oqiYFStGVjEhTqxL:uXVdBC5OEnwG7XIoOefH2oYfgTq

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://woodsofwhitehurst.com/forum/viewtopic.php

http://americanmallmodelsearch.com/forum/viewtopic.php

http://ammsatlanta.com/forum/viewtopic.php

http://ammsboston.com/forum/viewtopic.php
Attributes
  • payload_url

    http://creativefly.com/9jj2.exe

    http://digitalgate.tv/x2tp.exe

    http://ftp.hudsonhort.net/JJP.exe

    http://lizzyw.com/iPt3Yxz.exe

Targets

    • Target

      JaffaCakes118_6120245ef7572b4021492e23e2c18000

    • Size

      117KB

    • MD5

      6120245ef7572b4021492e23e2c18000

    • SHA1

      bd5b74df8c47da3f6b7631374be8a0d67d096a12

    • SHA256

      02e48eec2b659e428c7586dcdad68521a398e82d2a1110b99f5b2f2b12a11202

    • SHA512

      b432a346e68c9b62392763d8c24568b3232850a68798164b5dc1fe60f9d5bb79aae6685ba45a31a6529659960e3e9635da45944fec5cb5b78f8726ca31b29c2f

    • SSDEEP

      1536:uX8BEfVB9tu5O/8nwRY7zlxwBNZR8O+4gu2fx92oqiYFStGVjEhTqxL:uXVdBC5OEnwG7XIoOefH2oYfgTq

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks