Overview

overview

10

Static

static

10

JaffaCakes...58.exe

windows7-x64

10

JaffaCakes...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_012751015791ac3e270276707467ef58

  • Size

    90KB

  • Sample

    250121-bxf7sayrgn

  • MD5

    012751015791ac3e270276707467ef58

  • SHA1

    7f7b18d983fc15c75fe7d86216be2e5aebe95722

  • SHA256

    0051fcd73bd3ebf8c5657b960e5ff08d1cb00e87d31f770a2227d7822b82a3e8

  • SHA512

    eca33c6f7d4d4faa715eff32b9ba1c43227952df29c0d9b1e31de618023a468a76f1e92ba0c68b641288afa24da2d0fd7d30a02b40f8b5e63e9e1ed98c45cc99

  • SSDEEP

    1536:4Tz3OcSNTqTlBV7s75OLuz3JU2pdiustaLloOFkeCTvSEyBkzZt6Z:YrmN7OLuz3e2pEhtOFD5Eyqt6Z

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://4.professionalsoft.com/ponyd/gate.php

http://4.promatika.com/ponyd/gate.php
Attributes
  • payload_url

    http://ftp.sveikasdumas.lt/9oQB5YNa.exe

    http://sol-electrica.com/dbsQ.exe

    http://stockinter.intersport.es/MU4jW3pk.exe

    http://europadesign.altervista.org/MVAAJ.exe

    http://healthblognetworks.com/Nt5p7X.exe

    http://energy-without-carbon.com/YPHHERQ.exe

    http://frenchhairstudio.com/t66MT6.exe

    http://efumi.bokunenjin.com/wXQy.exe

Targets

    • Target

      JaffaCakes118_012751015791ac3e270276707467ef58

    • Size

      90KB

    • MD5

      012751015791ac3e270276707467ef58

    • SHA1

      7f7b18d983fc15c75fe7d86216be2e5aebe95722

    • SHA256

      0051fcd73bd3ebf8c5657b960e5ff08d1cb00e87d31f770a2227d7822b82a3e8

    • SHA512

      eca33c6f7d4d4faa715eff32b9ba1c43227952df29c0d9b1e31de618023a468a76f1e92ba0c68b641288afa24da2d0fd7d30a02b40f8b5e63e9e1ed98c45cc99

    • SSDEEP

      1536:4Tz3OcSNTqTlBV7s75OLuz3JU2pdiustaLloOFkeCTvSEyBkzZt6Z:YrmN7OLuz3e2pEhtOFD5Eyqt6Z

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks