Overview

overview

10

Static

static

3

JaffaCakes...20.exe

windows7-x64

10

JaffaCakes...20.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_64671282fe8470b115931e3c43abd520

  • Size

    119KB

  • Sample

    250102-mge6bsxpaz

  • MD5

    64671282fe8470b115931e3c43abd520

  • SHA1

    e8c52d56ba87e8427ee68e3cdec5e057826bceda

  • SHA256

    b6d063f25c32ff0c4da45579226b92a165076ecd08c247d9cfefadfd934d04fb

  • SHA512

    949dbdbefa5df5117142905f73f6217da93fce94fc9c1017191fea71d5912b77e242b96af206ea57572c5a8ea0612273c06237fb8a7c9f835fbd1f4fdbbd9e6e

  • SSDEEP

    3072:O4cu+vMJRiK/qJcHWM6ayj83tL/9Y+yWCr6QzpYl9:YKRTt2M6ayY39/TDCOMpYl9

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://conferenceanywhere.mobi/forum/viewtopic.php

http://customercaddie.com/forum/viewtopic.php

http://customercaddie.mobi/forum/viewtopic.php

http://eventbooklet.com/forum/viewtopic.php
Attributes
  • payload_url

    http://globaldoesitall.com/hPr0.exe

    http://derricoassociati.it/rjrtYyw5.exe

    http://9ain.net/easm1.exe

    http://alteredspaces.ca/sUDtTvrR.exe

Targets

    • Target

      JaffaCakes118_64671282fe8470b115931e3c43abd520

    • Size

      119KB

    • MD5

      64671282fe8470b115931e3c43abd520

    • SHA1

      e8c52d56ba87e8427ee68e3cdec5e057826bceda

    • SHA256

      b6d063f25c32ff0c4da45579226b92a165076ecd08c247d9cfefadfd934d04fb

    • SHA512

      949dbdbefa5df5117142905f73f6217da93fce94fc9c1017191fea71d5912b77e242b96af206ea57572c5a8ea0612273c06237fb8a7c9f835fbd1f4fdbbd9e6e

    • SSDEEP

      3072:O4cu+vMJRiK/qJcHWM6ayj83tL/9Y+yWCr6QzpYl9:YKRTt2M6ayY39/TDCOMpYl9

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks