pony | 1e56c1313b99673d1b705d9916df0b8e0f9da9f46b3fa59a1f99b64168404100

General

Target

1e56c1313b99673d1b705d9916df0b8e0f9da9f46b3fa59a1f99b64168404100.exe
Size

485KB
Sample

220514-q5k82aaac2
MD5

6629933020c2ba9ceabd5243ef6a8a5c
SHA1

d28fe16ecdf545bf3bc25d1ca43a749f4aa54d86
SHA256

1e56c1313b99673d1b705d9916df0b8e0f9da9f46b3fa59a1f99b64168404100
SHA512

06d1b85bd6c2b8e256ef59b0bd20d9debd203d11248000babe9077213fd24104a312a0c88f3f2cf267ce72d85b5a3c609ef0d2e286d0420004ab01d926fb1a85

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://al-shifaa.com/cubby/gate.php

Targets

- Target
  
  1e56c1313b99673d1b705d9916df0b8e0f9da9f46b3fa59a1f99b64168404100.exe
- Size
  
  485KB
- MD5
  
  6629933020c2ba9ceabd5243ef6a8a5c
- SHA1
  
  d28fe16ecdf545bf3bc25d1ca43a749f4aa54d86
- SHA256
  
  1e56c1313b99673d1b705d9916df0b8e0f9da9f46b3fa59a1f99b64168404100
- SHA512
  
  06d1b85bd6c2b8e256ef59b0bd20d9debd203d11248000babe9077213fd24104a312a0c88f3f2cf267ce72d85b5a3c609ef0d2e286d0420004ab01d926fb1a85
Score

10^/10

pony collection discovery rat spyware stealer suricata upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
  suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
  suricata
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2