Overview

overview

10

Static

static

3

JaffaCakes...85.exe

windows7-x64

10

JaffaCakes...85.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0cba3634f2f90ac1d235af235f3a1b85

  • Size

    109KB

  • Sample

    250122-mbwk5a1nex

  • MD5

    0cba3634f2f90ac1d235af235f3a1b85

  • SHA1

    c5d3349b8cb98c4de7c487332510951ce28fcc2c

  • SHA256

    3fd19aa44d2767345d849170f9dbae4b6b98dca33a6344d1dbbc2146f275f388

  • SHA512

    62fd1c450350bcd4a3023e9a519dd427a010731fba170df5a58bb0e8029efee6d574bc56dea57a7f498e6e6f3ae9e39a21071a60df3a1b9c59b48292ea0396ff

  • SSDEEP

    3072:N6LD2K31+VVxHp87XHuaYnOhyk54S6vxLfPc7d2:Nm3AV3urHudOhykWSCL8

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://ws.sefairepayer.com:8080/ponyb/gate.php

http://imprimante.sefairepayer.com:8080/ponyb/gate.php

http://91.121.204.38:8080/ponyb/gate.php

http://217.195.200.29:8080/ponyb/gate.php
Attributes
  • payload_url

    http://doomnet.de/eFkN8b.exe

    http://transzendenz.org/fmaFLg.exe

    http://ftp.crfhealth.com/SXz.exe

    http://corcorantool.com/H3HMy5.exe

    http://projet3il.fr/xmKob14.exe

Targets

    • Target

      JaffaCakes118_0cba3634f2f90ac1d235af235f3a1b85

    • Size

      109KB

    • MD5

      0cba3634f2f90ac1d235af235f3a1b85

    • SHA1

      c5d3349b8cb98c4de7c487332510951ce28fcc2c

    • SHA256

      3fd19aa44d2767345d849170f9dbae4b6b98dca33a6344d1dbbc2146f275f388

    • SHA512

      62fd1c450350bcd4a3023e9a519dd427a010731fba170df5a58bb0e8029efee6d574bc56dea57a7f498e6e6f3ae9e39a21071a60df3a1b9c59b48292ea0396ff

    • SSDEEP

      3072:N6LD2K31+VVxHp87XHuaYnOhyk54S6vxLfPc7d2:Nm3AV3urHudOhykWSCL8

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks