Overview

overview

10

Static

static

79b18eb465...92.exe

windows7_x64

3

79b18eb465...92.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79b18eb46544d371c9eb56ca68817206c907e6fb681481d7546a6ff6e7130492.exe

  • Size

    1.1MB

  • Sample

    220521-yhyvlsdac7

  • MD5

    d3021071b734890e96b5c842a110b0a9

  • SHA1

    4641e2b0cc28e0fbab2770b518026d7a84e1556d

  • SHA256

    79b18eb46544d371c9eb56ca68817206c907e6fb681481d7546a6ff6e7130492

  • SHA512

    65b3b0e663f9d88d854774f9846599059eec4a87c7cac5c6c55f77092d017dc26a8af464e105df23a26ba0e61c567aa55efae80f7ae7874c2727d1f6f43565f6

Score
10/10
ponyratspywarestealer

Malware Config

Extracted

Family

pony

C2

https://goodservices.co.vu/https://goodservices.co.vu/hcox/panel/gate.php

Attributes
  • payload_url

    https://goodservices.co.vu/shit.exe

Targets

    • Target

      79b18eb46544d371c9eb56ca68817206c907e6fb681481d7546a6ff6e7130492.exe

    • Size

      1.1MB

    • MD5

      d3021071b734890e96b5c842a110b0a9

    • SHA1

      4641e2b0cc28e0fbab2770b518026d7a84e1556d

    • SHA256

      79b18eb46544d371c9eb56ca68817206c907e6fb681481d7546a6ff6e7130492

    • SHA512

      65b3b0e663f9d88d854774f9846599059eec4a87c7cac5c6c55f77092d017dc26a8af464e105df23a26ba0e61c567aa55efae80f7ae7874c2727d1f6f43565f6

    Score
    10/10
    ponyratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks