pony | 9fbe995283a7e8178836cf2fc61bb744a62dc4d08667a9d0176ad4e8f7304036

General

Target

9fbe995283a7e8178836cf2fc61bb744a62dc4d08667a9d0176ad4e8f7304036.exe
Size

88KB
Sample

220521-yhzrxagcbr
MD5

db49bf0f3b883a1f1a91266f817641f0
SHA1

b30f5615cc3a365b884d9a2a5a20f9c81ab9b2fb
SHA256

9fbe995283a7e8178836cf2fc61bb744a62dc4d08667a9d0176ad4e8f7304036
SHA512

d4a1867f1212719b39b2717c5a4c91e3b980ba80516fad4ad90ceb297a328874856f5a63a3eb31d7ba9abb6d44a106f84bed76da26f5b88c00e03dcc01e6379a

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://odtpl.com/default.php?JU4q2x55JUQwVFnfR1pBKWLhzkD1UerkWCfKjzYBnP

http://visionnairecafegurgaon.com/default.php?fifwZkKfehjCbRZSSOLtCEUD3

http://sstindia.in/default.php?oYWZHcE86xVKSVVcJZoCDypOBy5A1MTUs6XSNsG6

http://oldspringdalians.com/default.php?hdpLkH8SZPMoeP6WqimjMPUzy7CTgJX

http://aonebioinstitute.com/default.php?eQDS6Tc6rsf3PeHM57ATRtqebiraejv

Targets

- Target
  
  9fbe995283a7e8178836cf2fc61bb744a62dc4d08667a9d0176ad4e8f7304036.exe
- Size
  
  88KB
- MD5
  
  db49bf0f3b883a1f1a91266f817641f0
- SHA1
  
  b30f5615cc3a365b884d9a2a5a20f9c81ab9b2fb
- SHA256
  
  9fbe995283a7e8178836cf2fc61bb744a62dc4d08667a9d0176ad4e8f7304036
- SHA512
  
  d4a1867f1212719b39b2717c5a4c91e3b980ba80516fad4ad90ceb297a328874856f5a63a3eb31d7ba9abb6d44a106f84bed76da26f5b88c00e03dcc01e6379a
Score

10^/10

pony collection discovery rat spyware stealer suricata
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
  suricata
- suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
  suricata
- suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
  suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
  suricata
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2