Overview

overview

10

Static

static

3

JaffaCakes...33.dll

windows7-x64

10

JaffaCakes...33.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_07259c2c145c528cdb900eba0184ed33

  • Size

    76KB

  • Sample

    250121-ys9pvsynax

  • MD5

    07259c2c145c528cdb900eba0184ed33

  • SHA1

    c6016af0bd79ced57c4ec4e095eb819390927535

  • SHA256

    8782cdde74eb73b2aee88eaf9c874ab992afcbf8e5cc5ec7c0d01c8df0bdfcd5

  • SHA512

    e409981cd9bbb7a3fe10d49c8e2042cd47cc7d6bbe881db5aae49dda0e3093d8199d1661afac2b7dc55f52fabed0073939a273413aa309cfde48e2ee65a2999b

  • SSDEEP

    1536:4cOhGnTBlIcWBy0PGfhs2j48dAIEGTpN+q2ZX5MhI:qolEc0efh5jHSI/pN+q2ZXKhI

Score
10/10
ponycredential_accessdiscoveryratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_07259c2c145c528cdb900eba0184ed33

    • Size

      76KB

    • MD5

      07259c2c145c528cdb900eba0184ed33

    • SHA1

      c6016af0bd79ced57c4ec4e095eb819390927535

    • SHA256

      8782cdde74eb73b2aee88eaf9c874ab992afcbf8e5cc5ec7c0d01c8df0bdfcd5

    • SHA512

      e409981cd9bbb7a3fe10d49c8e2042cd47cc7d6bbe881db5aae49dda0e3093d8199d1661afac2b7dc55f52fabed0073939a273413aa309cfde48e2ee65a2999b

    • SSDEEP

      1536:4cOhGnTBlIcWBy0PGfhs2j48dAIEGTpN+q2ZX5MhI:qolEc0efh5jHSI/pN+q2ZXKhI

    Score
    10/10
    ponycredential_accessdiscoveryratspywarestealerupx

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks