Overview

overview

10

Static

static

3

26eec7f89b...18.exe

windows7-x64

10

26eec7f89b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26eec7f89b98e56bf28db7c9add39a6f_JaffaCakes118

  • Size

    129KB

  • Sample

    240705-qcva8s1fjc

  • MD5

    26eec7f89b98e56bf28db7c9add39a6f

  • SHA1

    45ee2b07145d2b714c48f6f5b966d16823dd4b35

  • SHA256

    16ffd86b1b1ecad010a3aff298c9ce2cb6585318c6feecb9ce98de5886a07714

  • SHA512

    15ac115691b9d91f85c9b30ed60487e13c16c0fea6c7dfb0c74fcc7f7ce94d41fceef7f598e452073bb67a50aa7637c3d35db9b2938ca46a678f27b055999caf

  • SSDEEP

    1536:UUBiFqtXmPmgC9B2lciLKuIHe9J46geNIvB3Qo+OB6FLsjL7k3JhYxYYG0L1UldF:UOn16mg2olbvdY1ZvpQxOAJhcf0E

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://74.91.117.168/forum/viewtopic.php
Attributes
  • payload_url

    http://cpps.or.id/KwV8AXN.exe

    http://citleg.org/UptP.exe

    http://text-konverter.homepage.t-online.de/xr0C7eW.exe

Targets

    • Target

      26eec7f89b98e56bf28db7c9add39a6f_JaffaCakes118

    • Size

      129KB

    • MD5

      26eec7f89b98e56bf28db7c9add39a6f

    • SHA1

      45ee2b07145d2b714c48f6f5b966d16823dd4b35

    • SHA256

      16ffd86b1b1ecad010a3aff298c9ce2cb6585318c6feecb9ce98de5886a07714

    • SHA512

      15ac115691b9d91f85c9b30ed60487e13c16c0fea6c7dfb0c74fcc7f7ce94d41fceef7f598e452073bb67a50aa7637c3d35db9b2938ca46a678f27b055999caf

    • SSDEEP

      1536:UUBiFqtXmPmgC9B2lciLKuIHe9J46geNIvB3Qo+OB6FLsjL7k3JhYxYYG0L1UldF:UOn16mg2olbvdY1ZvpQxOAJhcf0E

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks