pony | c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43

General

Target

6EA14E473644F3BEA03782F41D7C5246.exe
Size

696KB
Sample

210717-pkcgg2tg7j
MD5

6ea14e473644f3bea03782f41d7c5246
SHA1

3be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256

c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA512

7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://fuckoff.av.com/gate.php

http://mrson.dan.al/sddob/gate.php

Targets

- Target
  
  6EA14E473644F3BEA03782F41D7C5246.exe
- Size
  
  696KB
- MD5
  
  6ea14e473644f3bea03782f41d7c5246
- SHA1
  
  3be05d9f18b574c5c4eea2f8ab8160c470553aeb
- SHA256
  
  c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
- SHA512
  
  7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
Score

10^/10

pony discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

Suspicious use of NtCreateProcessExOtherParentProcess

Executes dropped EXE

UPX packed file

Drops startup file

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2