Overview

overview

10

Static

static

1

JaffaCakes...23.exe

windows7-x64

10

JaffaCakes...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_07d941ad22f86e246b78d1eff7d13a23

  • Size

    194KB

  • Sample

    250121-1zgzjatjav

  • MD5

    07d941ad22f86e246b78d1eff7d13a23

  • SHA1

    f2e328e09717ae86221e53b7c2a9d40d38d5b835

  • SHA256

    28d9d6d249904f9636daf77ce6175fc05585188515f74b97137917a2114ed01b

  • SHA512

    0ea99dcbdb2d38418a159ab3b3037726b217afafa1a61ea56435dc5b802d1ae42e729e2839eec68dc761941fef9ada6ae6312dc552e375db8ae9a824f62c3e4d

  • SSDEEP

    1536:B6me1h2CM0JN9L0bZt9s5j9OS3lQD/wMBbnoXpy1jmPkeGxZEHG4yWpIADiIADzU:B6m90JI1gl9OKlQ4KbnMMeGxUByWpWfU

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://node01.geoborders.net:8080/forum/viewtopic.php

http://91.121.1.54:8080/forum/viewtopic.php

http://72.243.190.162:8080/forum/viewtopic.php

http://sms.theliontel.com:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://errolbauer.hostingsociety.com/hRisku8.exe

    http://the-way-around.de/wNWzEp.exe

    http://www.spec07.dircon.co.uk/rnf.exe

Targets

    • Target

      JaffaCakes118_07d941ad22f86e246b78d1eff7d13a23

    • Size

      194KB

    • MD5

      07d941ad22f86e246b78d1eff7d13a23

    • SHA1

      f2e328e09717ae86221e53b7c2a9d40d38d5b835

    • SHA256

      28d9d6d249904f9636daf77ce6175fc05585188515f74b97137917a2114ed01b

    • SHA512

      0ea99dcbdb2d38418a159ab3b3037726b217afafa1a61ea56435dc5b802d1ae42e729e2839eec68dc761941fef9ada6ae6312dc552e375db8ae9a824f62c3e4d

    • SSDEEP

      1536:B6me1h2CM0JN9L0bZt9s5j9OS3lQD/wMBbnoXpy1jmPkeGxZEHG4yWpIADiIADzU:B6m90JI1gl9OKlQ4KbnMMeGxUByWpWfU

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks