Overview

overview

10

Static

static

10

2685d9e98f...ed.exe

windows7_x64

10

2685d9e98f...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed.exe

  • Size

    84KB

  • Sample

    220521-yhzf5sgcbj

  • MD5

    009aef3fc495cd2f1ebb6789f7009e4e

  • SHA1

    64c633e0af7ae1e313a15a33ac470aa5baa44ad7

  • SHA256

    2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed

  • SHA512

    a173038fb17aab61e5f8be7e72b6e4bbce38f65c344af0e4212d0e60f6b49d9ce10dc8e1547a5ce5d3a365de45d96e8166c02b10a616462930435d75387dae23

Score
10/10
ponydiscoveryratspywarestealersuricata

Malware Config

Extracted

Family

pony

C2

http://caitymccardell.com/wp-content/upd.php

http://childrensranchpdc.com/wp-content/upd.php

http://teach4god.com/blog/wp-content/upd.php
Attributes
  • payload_url

    http://bealkalinenow.com/wp-content/fe/1.exe

    http://bealkalinenow.com/wp-content/fe/2.exe

    http://bealkalinenow.com/wp-content/fe/3.exe

Targets

    • Target

      2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed.exe

    • Size

      84KB

    • MD5

      009aef3fc495cd2f1ebb6789f7009e4e

    • SHA1

      64c633e0af7ae1e313a15a33ac470aa5baa44ad7

    • SHA256

      2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed

    • SHA512

      a173038fb17aab61e5f8be7e72b6e4bbce38f65c344af0e4212d0e60f6b49d9ce10dc8e1547a5ce5d3a365de45d96e8166c02b10a616462930435d75387dae23

    Score
    10/10
    ponydiscoveryratspywarestealersuricata

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • suricata: ET MALWARE Fareit/Pony Downloader Checkin 2

      suricata: ET MALWARE Fareit/Pony Downloader Checkin 2

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks