Overview

overview

10

Static

static

ECF21D23BC...23.exe

windows7_x64

10

ECF21D23BC...23.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ECF21D23BC761CD82181A9C50C8E7323.exe

  • Size

    1.4MB

  • Sample

    210507-smsvdlpkl6

  • MD5

    ecf21d23bc761cd82181a9c50c8e7323

  • SHA1

    4175dd599ca9dce7a9c4d2c7bcfdf4738164a162

  • SHA256

    f515d67b069dfb177559d773b872dfeacadbfbdb4dde4a7903357b6dc181087f

  • SHA512

    8843675a5354b74c18863c17053f64fef1c5d62cd0a6c84bf493bc50756dd389be45895de6c4a6ff5ea079ba22a1477bc1924a31928733f8797240e5ae779966

Score
10/10
ponypersistenceratspywarestealer

Malware Config

Targets

    • Target

      ECF21D23BC761CD82181A9C50C8E7323.exe

    • Size

      1.4MB

    • MD5

      ecf21d23bc761cd82181a9c50c8e7323

    • SHA1

      4175dd599ca9dce7a9c4d2c7bcfdf4738164a162

    • SHA256

      f515d67b069dfb177559d773b872dfeacadbfbdb4dde4a7903357b6dc181087f

    • SHA512

      8843675a5354b74c18863c17053f64fef1c5d62cd0a6c84bf493bc50756dd389be45895de6c4a6ff5ea079ba22a1477bc1924a31928733f8797240e5ae779966

    Score
    10/10
    ponypersistenceratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks