Overview

overview

10

Static

static

3

JaffaCakes...bd.exe

windows7-x64

10

JaffaCakes...bd.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_779e3ecd18de89e4e14179c5e8edcabd

  • Size

    121KB

  • Sample

    250104-e1v2ws1pgs

  • MD5

    779e3ecd18de89e4e14179c5e8edcabd

  • SHA1

    359aedfc19776b8f0b8cc71bbb246fe211c096bb

  • SHA256

    e57b6687c3c30b4f948ef5258c0a3599a7814c0d7811df8fd19c86f29ac9d711

  • SHA512

    cc4d7732fe07838e3a44b2ff6465acb00832c5a0ffa8f32a3adef9fe81fd19faa776eed74254ca1ae5623c6946609727161813e0e01bb45350edd309b28ebc9a

  • SSDEEP

    1536:dwH8RioqfLl7tzxwMfWatvxXUG/NyAkYFSvFL/fnPY3DXqsw8TieDHVfAt7:N8BjltzthvvXFqL/I3D5w8+eRW7

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://www.arki.com:8080/forum/viewtopic.php

http://arki.com:8080/forum/viewtopic.php

http://50.57.185.72:8080/forum/viewtopic.php

http://catchcrooks.com/forum/viewtopic.php
Attributes
  • payload_url

    http://s201964868.onlinehome.us/D0fzN.exe

    http://myshoppingbusiness.com/ngyLs.exe

    http://teknozonepakistan.com/z2XFSBT.exe

    http://enviboats.com/sNp.exe

Targets

    • Target

      JaffaCakes118_779e3ecd18de89e4e14179c5e8edcabd

    • Size

      121KB

    • MD5

      779e3ecd18de89e4e14179c5e8edcabd

    • SHA1

      359aedfc19776b8f0b8cc71bbb246fe211c096bb

    • SHA256

      e57b6687c3c30b4f948ef5258c0a3599a7814c0d7811df8fd19c86f29ac9d711

    • SHA512

      cc4d7732fe07838e3a44b2ff6465acb00832c5a0ffa8f32a3adef9fe81fd19faa776eed74254ca1ae5623c6946609727161813e0e01bb45350edd309b28ebc9a

    • SSDEEP

      1536:dwH8RioqfLl7tzxwMfWatvxXUG/NyAkYFSvFL/fnPY3DXqsw8TieDHVfAt7:N8BjltzthvvXFqL/I3D5w8+eRW7

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks