Overview

overview

10

Static

static

3

JaffaCakes...03.exe

windows7-x64

10

JaffaCakes...03.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_924f6894b7eaa578234c87fb3929a103

  • Size

    127KB

  • Sample

    250329-xbg3vavny7

  • MD5

    924f6894b7eaa578234c87fb3929a103

  • SHA1

    8f19486f627cc0f3da83ffc5e8e21b717645e66a

  • SHA256

    a9af96637653fe15d53ce3f772d1ec12816375bad1ad6c0965acb2d8f7ba2c59

  • SHA512

    8db8a81849de2b65a421fd114411e8d397445dc817d202e305a5f261e81f6e3e9d592f43b7b58a269971c29628512d4a34f7a3896c385eaa8bd8dffad979caac

  • SSDEEP

    1536:hcSlTDd4nLWeHQb9nddS+IP4h3v2WcRvq0V1pXcEgW6/zxDMMgaRPdoZruV1Fq/Z:HlTWLWuU9nddSaGRvkNfVY/EyZAvM9

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://mail.yaklasim.com:8080/forum/viewtopic.php

http://reubenpacheco.com/forum/viewtopic.php

http://reubenpacheco.tv/forum/viewtopic.php

http://sherman-oaks-condos-for-sale.com/forum/viewtopic.php
Attributes
  • payload_url

    http://www.brozziassicurazioni.it/DEs.exe

    http://oparkaindustries.com/aLuAubms.exe

    http://metalgold.com.mx/Aiu.exe

    http://ftp.magnusondesign.com/ysSbZnV.exe

Targets

    • Target

      JaffaCakes118_924f6894b7eaa578234c87fb3929a103

    • Size

      127KB

    • MD5

      924f6894b7eaa578234c87fb3929a103

    • SHA1

      8f19486f627cc0f3da83ffc5e8e21b717645e66a

    • SHA256

      a9af96637653fe15d53ce3f772d1ec12816375bad1ad6c0965acb2d8f7ba2c59

    • SHA512

      8db8a81849de2b65a421fd114411e8d397445dc817d202e305a5f261e81f6e3e9d592f43b7b58a269971c29628512d4a34f7a3896c385eaa8bd8dffad979caac

    • SSDEEP

      1536:hcSlTDd4nLWeHQb9nddS+IP4h3v2WcRvq0V1pXcEgW6/zxDMMgaRPdoZruV1Fq/Z:HlTWLWuU9nddSaGRvkNfVY/EyZAvM9

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks