General

  • Target

    JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a

  • Size

    127KB

  • Sample

    250129-a7f44ayngj

  • MD5

    50fdb69b11956e5ed93d58db354b2f0a

  • SHA1

    e5df6860acaf3beff599903a50b292ff18dfd352

  • SHA256

    06d6ba6e3dbf1a2e226fa518b9ddda0da9548a7b60e5bf303e0e9a5f6eae4023

  • SHA512

    f62632a7313c137d5aef5ee322658267ddd978f6a2aa1dd91001211a38a461679164dbf5f829a612311eee242cdbf58e7a4b91ddb6186ec912756bde936576a1

  • SSDEEP

    1536:s+5DMoxyY+PG35SbdnS4SKEFhAi0sIz5I7+q7SIqlysxPg7DeS/6q4XOYqxn0k6:KoxhYbdnpSpasIzHqpqqr4Xhqxn0k6

Malware Config

Extracted

Family

pony

C2

http://108.166.65.182:8080/pony/gate.php

http://aloucakbileti.com:8080/pony/gate.php

Attributes
  • payload_url

    http://aceite.elovantagens.com.br/os1Giry.exe

    http://talentquest.com.mx/1MPj.exe

    http://zirmatech.com.br/9exoNyD3.exe

    http://apostagol1.web102.f1.k8.com.br/782V.exe

Targets

    • Target

      JaffaCakes118_50fdb69b11956e5ed93d58db354b2f0a

    • Size

      127KB

    • MD5

      50fdb69b11956e5ed93d58db354b2f0a

    • SHA1

      e5df6860acaf3beff599903a50b292ff18dfd352

    • SHA256

      06d6ba6e3dbf1a2e226fa518b9ddda0da9548a7b60e5bf303e0e9a5f6eae4023

    • SHA512

      f62632a7313c137d5aef5ee322658267ddd978f6a2aa1dd91001211a38a461679164dbf5f829a612311eee242cdbf58e7a4b91ddb6186ec912756bde936576a1

    • SSDEEP

      1536:s+5DMoxyY+PG35SbdnS4SKEFhAi0sIz5I7+q7SIqlysxPg7DeS/6q4XOYqxn0k6:KoxhYbdnpSpasIzHqpqqr4Xhqxn0k6

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks