pony | 3ebdd7d753526d8767e108598ce91c2f1c00f506a7413f65899f8c279cc031de | Triage

Sharing

General

Target

3ebdd7d753526d8767e108598ce91c2f1c00f506a7413f65899f8c279cc031de.exe
Size

90KB
Sample

201107-3yg317qhks
MD5

d7325ce799aad3846363fbd2b2572dd0
SHA1

9248bb35d4cb664a1def67bf5867ffe3eabaf048
SHA256

3ebdd7d753526d8767e108598ce91c2f1c00f506a7413f65899f8c279cc031de
SHA512

3b16148b2134b3eda7e41acc27f30667dabf31865ba049c957836878cc7050b68bef53ba5c229076c3a26ca54f6a7f36f1c8bb77d18eada9d45ec5e649ddcafc

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Targets

- Target
  
  3ebdd7d753526d8767e108598ce91c2f1c00f506a7413f65899f8c279cc031de.exe
- Size
  
  90KB
- MD5
  
  d7325ce799aad3846363fbd2b2572dd0
- SHA1
  
  9248bb35d4cb664a1def67bf5867ffe3eabaf048
- SHA256
  
  3ebdd7d753526d8767e108598ce91c2f1c00f506a7413f65899f8c279cc031de
- SHA512
  
  3b16148b2134b3eda7e41acc27f30667dabf31865ba049c957836878cc7050b68bef53ba5c229076c3a26ca54f6a7f36f1c8bb77d18eada9d45ec5e649ddcafc
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer