Overview

overview

10

Static

static

3

JaffaCakes...b0.exe

windows7-x64

10

JaffaCakes...b0.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7c1c369ed1388e96789cabf1ddc333b0

  • Size

    118KB

  • Sample

    250104-11cq7s1qhr

  • MD5

    7c1c369ed1388e96789cabf1ddc333b0

  • SHA1

    27a23fe75816f957615fe4a03a3acac34153647b

  • SHA256

    c0451b37d7a8cc852a8bced0d2ff3e6b93858f7d89630c5885e462fd4d3a9d7b

  • SHA512

    ec8929471e6f82cf9dbddb7ea87ff538449e788c69cbcb165b7b6163bb91d3549c3cc9353577233e291b1b56d98288fe388f5b5596fb5baa2a5799d2168c94d0

  • SSDEEP

    1536:Juk4z8aAbLnIyCajwyHhrFixeqE38kshKOPd1l6czF3oNCqGqo6Fodbhi9pMXJSC:JdhgFE6hXPd/F8C56FIhi9GXJuZs

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://supportquilting.com/forum/viewtopic.php

http://eaglebay-eb5.com/forum/viewtopic.php

http://eaglebay5.com/forum/viewtopic.php

http://wcaband.org/forum/viewtopic.php
Attributes
  • payload_url

    http://ftp.ixcenter.com/juA3j.exe

    http://www.movimento5stellesorrento.com/s2w.exe

    http://newsouthdental.com/4JX.exe

    http://hkcps.com.cn/duFpAk.exe

Targets

    • Target

      JaffaCakes118_7c1c369ed1388e96789cabf1ddc333b0

    • Size

      118KB

    • MD5

      7c1c369ed1388e96789cabf1ddc333b0

    • SHA1

      27a23fe75816f957615fe4a03a3acac34153647b

    • SHA256

      c0451b37d7a8cc852a8bced0d2ff3e6b93858f7d89630c5885e462fd4d3a9d7b

    • SHA512

      ec8929471e6f82cf9dbddb7ea87ff538449e788c69cbcb165b7b6163bb91d3549c3cc9353577233e291b1b56d98288fe388f5b5596fb5baa2a5799d2168c94d0

    • SSDEEP

      1536:Juk4z8aAbLnIyCajwyHhrFixeqE38kshKOPd1l6czF3oNCqGqo6Fodbhi9pMXJSC:JdhgFE6hXPd/F8C56FIhi9GXJuZs

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks