pony | 2213dfa0542f7e14d95cfaaa34db8431f4ccdecf0e584d529597d441a263e40b | Triage

Sharing

General

Target

2213dfa0542f7e14d95cfaaa34db8431f4ccdecf0e584d529597d441a263e40b
Size

105KB
Sample

201114-wcas9cmsme
MD5

b2eda99aad21d20d9462d24957c8ce2c
SHA1

84d22970938665c406e33e58376376bdfde08682
SHA256

2213dfa0542f7e14d95cfaaa34db8431f4ccdecf0e584d529597d441a263e40b
SHA512

84e7cc1c60bdd5f68f297a0085286dfb35cd02dcebb939fc0f5afd0b976172b0be581a5e5b0f43463fd998f6d770c4b6c537a9a031a4ea53dcbfc9d13b764068

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Targets

- Target
  
  2213dfa0542f7e14d95cfaaa34db8431f4ccdecf0e584d529597d441a263e40b
- Size
  
  105KB
- MD5
  
  b2eda99aad21d20d9462d24957c8ce2c
- SHA1
  
  84d22970938665c406e33e58376376bdfde08682
- SHA256
  
  2213dfa0542f7e14d95cfaaa34db8431f4ccdecf0e584d529597d441a263e40b
- SHA512
  
  84e7cc1c60bdd5f68f297a0085286dfb35cd02dcebb939fc0f5afd0b976172b0be581a5e5b0f43463fd998f6d770c4b6c537a9a031a4ea53dcbfc9d13b764068
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer