Overview

overview

10

Static

static

fb30601d90...5b.exe

windows7_x64

10

fb30601d90...5b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe

  • Size

    1.1MB

  • Sample

    200707-fsg4nl8w9e

  • MD5

    32b2c85efdbb016ad3c04fd3e4ff4cee

  • SHA1

    828f0f32aca9eb4d144029919b0dac48ae34de1c

  • SHA256

    fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b

  • SHA512

    502e9c133d03cc01aa98a348eb46cea69fdd7e2b66ab759d54cc625779a052e89924a805bcf5a3a3954808b460f5297e2e9efb9f84fc675d57dd72ca62edb83b

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Targets

    • Target

      fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b.exe

    • Size

      1.1MB

    • MD5

      32b2c85efdbb016ad3c04fd3e4ff4cee

    • SHA1

      828f0f32aca9eb4d144029919b0dac48ae34de1c

    • SHA256

      fb30601d90268e316d5bbbe9e78bc1ad8acb4fe262d66b0a3f403425ad78f15b

    • SHA512

      502e9c133d03cc01aa98a348eb46cea69fdd7e2b66ab759d54cc625779a052e89924a805bcf5a3a3954808b460f5297e2e9efb9f84fc675d57dd72ca62edb83b

    Score
    10/10
    spywarediscoveryratstealerpony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Accesses cryptocurrency wallets, possible credential harvesting

      spyware

    • Checks for installed software on the system

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks