General

  • Target

    JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b

  • Size

    152KB

  • Sample

    250119-xj62ya1qbr

  • MD5

    d01f22d4d79a701c6e5f60495b5f264b

  • SHA1

    d62b0fb0af3c36d99f38bcac2bb95448da897ebc

  • SHA256

    37bb3ae756d865dcba75011ac2507d8f75da6655c0959a8bb8320b30ef6a52bc

  • SHA512

    7757037c4e62f6422636e77a1bd14c71f1482c8e517bdda95202fa669dc97016ca8203c242084d1b35e137518e92595abb4bef6785579ad67c452f9f35b2eab4

  • SSDEEP

    3072:ZRZgpCnOMTufH2YqelEWBnSz2tFfLVRDNKycG7/AFhtXC7XO6:ZRypCnOkOlEzzid/cQ4btSjO6

Malware Config

Extracted

Family

pony

C2

http://goatoncycle.com/forum/viewtopic.php

http://goatongoat.com/forum/viewtopic.php

Attributes
  • payload_url

    http://3073.a.hostable.me/Z2U.exe

    http://85.18.21.252/PNV3Hbi.exe

Targets

    • Target

      JaffaCakes118_d01f22d4d79a701c6e5f60495b5f264b

    • Size

      152KB

    • MD5

      d01f22d4d79a701c6e5f60495b5f264b

    • SHA1

      d62b0fb0af3c36d99f38bcac2bb95448da897ebc

    • SHA256

      37bb3ae756d865dcba75011ac2507d8f75da6655c0959a8bb8320b30ef6a52bc

    • SHA512

      7757037c4e62f6422636e77a1bd14c71f1482c8e517bdda95202fa669dc97016ca8203c242084d1b35e137518e92595abb4bef6785579ad67c452f9f35b2eab4

    • SSDEEP

      3072:ZRZgpCnOMTufH2YqelEWBnSz2tFfLVRDNKycG7/AFhtXC7XO6:ZRypCnOkOlEzzid/cQ4btSjO6

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.