Overview

overview

10

Static

static

3

JaffaCakes...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a16df9dcb1c71b2175905e711c76351d

  • Size

    138KB

  • Sample

    250408-y2r66s1sfy

  • MD5

    a16df9dcb1c71b2175905e711c76351d

  • SHA1

    8d25aefbd80a37c5a920c3d0380e97ebac760b98

  • SHA256

    3348716fc1a6d31d96399d7c360586e0e4729eb4a21a09c4b7da16e80610f348

  • SHA512

    46bc59798825ecaef39eb45bf9ed1dfe51ea8bf5f99dc09e1a831b64c86c6cac3ecd36c3556ee6d5cf1eb83942e5aafe51d434bcf9f8b4c95c6a477327c49cbb

  • SSDEEP

    3072:rNzgUlbjoM4QWsPDFW8nkyX+icc/1L8HS5NoTrOM:rR1+rsHkyuiB/mHE

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://lumberlandnorth.com:8080/ponyz/gate.php

http://mini101.ca:8080/ponyz/gate.php

http://biogenx.net:8080/ponyz/gate.php

http://datingandfriendfinder.net:8080/ponyz/gate.php
Attributes
  • payload_url

    http://wpn8u7k6c.homepage.t-online.de/gfmnXqw.exe

    http://pipepetrol.com/9cE0CkBn.exe

    http://morettiart.com/mu8qd.exe

Targets

    • Target

      JaffaCakes118_a16df9dcb1c71b2175905e711c76351d

    • Size

      138KB

    • MD5

      a16df9dcb1c71b2175905e711c76351d

    • SHA1

      8d25aefbd80a37c5a920c3d0380e97ebac760b98

    • SHA256

      3348716fc1a6d31d96399d7c360586e0e4729eb4a21a09c4b7da16e80610f348

    • SHA512

      46bc59798825ecaef39eb45bf9ed1dfe51ea8bf5f99dc09e1a831b64c86c6cac3ecd36c3556ee6d5cf1eb83942e5aafe51d434bcf9f8b4c95c6a477327c49cbb

    • SSDEEP

      3072:rNzgUlbjoM4QWsPDFW8nkyX+icc/1L8HS5NoTrOM:rR1+rsHkyuiB/mHE

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks