General

  • Target

    JaffaCakes118_0dd169ff5e263fa94619099c48048af8

  • Size

    2.2MB

  • Sample

    250604-1f7qvadp4y

  • MD5

    0dd169ff5e263fa94619099c48048af8

  • SHA1

    2f283184d40e8772aed86bab8cf17572c7a4fcfa

  • SHA256

    934f1557fa28ac463df7762ac8a76b906898bccc4e4670b8931a1f6e2797b891

  • SHA512

    bd19e59324126cc3e1b9c077baa1b82bf164cfcee484cddc15eea843f61a78786b932ad62d116a3ed1f76ee258ef0f2edd19e2a3f4d52815eb42e1228197a84a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWww8

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      JaffaCakes118_0dd169ff5e263fa94619099c48048af8

    • Size

      2.2MB

    • MD5

      0dd169ff5e263fa94619099c48048af8

    • SHA1

      2f283184d40e8772aed86bab8cf17572c7a4fcfa

    • SHA256

      934f1557fa28ac463df7762ac8a76b906898bccc4e4670b8931a1f6e2797b891

    • SHA512

      bd19e59324126cc3e1b9c077baa1b82bf164cfcee484cddc15eea843f61a78786b932ad62d116a3ed1f76ee258ef0f2edd19e2a3f4d52815eb42e1228197a84a

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWww8

    • Detects Mofksys worm

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Mofksys

      Mofksys is a worm written in VisualBasic.

    • Mofksys family

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks