pony | 69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968

General

Target

69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968.exe
Size

88KB
Sample

220521-yhz3nsdae5
MD5

8c1580411a7d21d740f1ed7c243f7060
SHA1

ac183ebf24df1f2391b42ba861eacca8291301d8
SHA256

69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968
SHA512

e2600d900768b823875acf3d6119f15a7b1c7ff78c2c97b5b20b116b4a55eff04e58a5e79fb48358a38fb9e31e2e2f83440137fe65e0cbed1b0e73f57c62a4d4

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://comune.fuscaldo.cs.it/default.php?w3kWNTZVZsbrWSu1qLiMz4BGdefdEb

http://poppahomes.com/default.php?OneQDmfn4Vs2vlhXJa5FoZfFe1y93xOtqEJHz

http://illinoisrates.com/default.php?PYeZNWDQjN2qNSClMOtNubM1xooCp2tixB

http://waldenserhof-springpferde.de/default.php?yTrSseoSJDg2Q7NRpO55suE

http://endless.svdownloadurl.com/default.php?d6ziFSWy45sJQcqgpS4qZr4RSw

Targets

- Target
  
  69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968.exe
- Size
  
  88KB
- MD5
  
  8c1580411a7d21d740f1ed7c243f7060
- SHA1
  
  ac183ebf24df1f2391b42ba861eacca8291301d8
- SHA256
  
  69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968
- SHA512
  
  e2600d900768b823875acf3d6119f15a7b1c7ff78c2c97b5b20b116b4a55eff04e58a5e79fb48358a38fb9e31e2e2f83440137fe65e0cbed1b0e73f57c62a4d4
Score

10^/10

pony collection discovery rat spyware stealer suricata
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata
- suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
  suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
  suricata
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2