pony | 45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0

General

Target

45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
Size

756KB
Sample

220521-yhyjvagbhn
MD5

bd91a8ac0f31d7717bb654a398e92b59
SHA1

722a0604c3709b7713114f934bde6730c4538d7a
SHA256

45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
SHA512

a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://198.27.98.247/Pony/gate.php

Targets

- Target
  
  45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0.exe
- Size
  
  756KB
- MD5
  
  bd91a8ac0f31d7717bb654a398e92b59
- SHA1
  
  722a0604c3709b7713114f934bde6730c4538d7a
- SHA256
  
  45fe119d5b7d73a1434401129c0ddbd0012399bcdb73c8a7f6878503146677b0
- SHA512
  
  a08aa1e05afdcabda6e18a7df5f93c6a35109d8f3344cf3e1160a0c7f62a82e82ad0330cf63635c2d83d5aa62442cc66faaef3053d71b3f9bfbc7989e68cc07f
Score

10^/10

pony collection discovery rat spyware stealer suricata
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata
- suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
  suricata: ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
  suricata
- suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
  suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
  suricata
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata
- suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
  suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
  suricata
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2