Overview

overview

10

Static

static

3

JaffaCakes...df.exe

windows7-x64

10

JaffaCakes...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0dac55afb0cc5fed4198a279c192d6df

  • Size

    147KB

  • Sample

    250122-psqsbaxmdr

  • MD5

    0dac55afb0cc5fed4198a279c192d6df

  • SHA1

    c7f10e0959dd2bcc80c8b906451a99ca963db416

  • SHA256

    15da1d91fc2ab1557887047cefcdc85a394a2dca32a58871cc920b137f00eb84

  • SHA512

    33efbeb5f87e5e8aa4ce2ba062f5026c055afd3af2094ece12b9d2858c88415567f541ed611c49944dbb46e492b013874428fb48f97ead60be963fd80bebf053

  • SSDEEP

    3072:bzxiBaeYkCirs+HVihhrE6eKBgs3lhpjp1nAA1WE:h60NMErEKgsj19z

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://66.55.89.148:8080/forum/viewtopic.php

http://66.55.89.149:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://underthepickletree.com.au/kmjeYdop.exe

    http://www.luxurytimedistribution.com/QGp2J.exe

    http://agileadmins.com/bFH0bg.exe

    http://erally.ro/dKXV3.exe

    http://elforodelasciencias.org/WjH72v.exe

    http://thestoremilano.com/TaVnSz14.exe

Targets

    • Target

      JaffaCakes118_0dac55afb0cc5fed4198a279c192d6df

    • Size

      147KB

    • MD5

      0dac55afb0cc5fed4198a279c192d6df

    • SHA1

      c7f10e0959dd2bcc80c8b906451a99ca963db416

    • SHA256

      15da1d91fc2ab1557887047cefcdc85a394a2dca32a58871cc920b137f00eb84

    • SHA512

      33efbeb5f87e5e8aa4ce2ba062f5026c055afd3af2094ece12b9d2858c88415567f541ed611c49944dbb46e492b013874428fb48f97ead60be963fd80bebf053

    • SSDEEP

      3072:bzxiBaeYkCirs+HVihhrE6eKBgs3lhpjp1nAA1WE:h60NMErEKgsj19z

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks