General

  • Target

    JaffaCakes118_8c8d8b07d464b6100c5f111e1a1ffb32

  • Size

    167KB

  • Sample

    250329-vs7zgstpv5

  • MD5

    8c8d8b07d464b6100c5f111e1a1ffb32

  • SHA1

    bafcf92251e1e7cd71004d4399a565efe0d87ac2

  • SHA256

    0e8be0b4b77d981c84cb3507bbcabb355c7084422ee8187bcd1cbb26e6fabf3b

  • SHA512

    ab2f888f5a402ec8ae4864b4f7b576c48692719061714974292a5660fa24d49031ad804f4ae86839b250004458556e700be268c7c85a8276d99552d83e90848c

  • SSDEEP

    3072:YVhJ+n5dTXuFLbqgEyfMuUaz4nQ4t4JpvyGZwWtFSpZLW+ymKCWQK:0hJkPTo3yJDS4K3vtAvyg+

Malware Config

Targets

    • Target

      JaffaCakes118_8c8d8b07d464b6100c5f111e1a1ffb32

    • Size

      167KB

    • MD5

      8c8d8b07d464b6100c5f111e1a1ffb32

    • SHA1

      bafcf92251e1e7cd71004d4399a565efe0d87ac2

    • SHA256

      0e8be0b4b77d981c84cb3507bbcabb355c7084422ee8187bcd1cbb26e6fabf3b

    • SHA512

      ab2f888f5a402ec8ae4864b4f7b576c48692719061714974292a5660fa24d49031ad804f4ae86839b250004458556e700be268c7c85a8276d99552d83e90848c

    • SSDEEP

      3072:YVhJ+n5dTXuFLbqgEyfMuUaz4nQ4t4JpvyGZwWtFSpZLW+ymKCWQK:0hJkPTo3yJDS4K3vtAvyg+

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks