pony | 46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad

General

Target

46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
Size

187KB
Sample

220714-j587jaebep
MD5

e00c36be7554448aaddde4ad7592709f
SHA1

b43d3a5867117265d44ceda4c703051024e80588
SHA256

46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
SHA512

2b4e6ebc09ce19023f95523e963f121b7feacca89207fb4cc49801afae0df741965212c3cc2d06d0130c03b45dc0238f50a1115fdbafcb6c2603787c8a69fbc3

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://www.p2kings.ga/p2/gate.php

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
- Size
  
  187KB
- MD5
  
  e00c36be7554448aaddde4ad7592709f
- SHA1
  
  b43d3a5867117265d44ceda4c703051024e80588
- SHA256
  
  46f18ac611cd974116aa94b4fb45343dcd727d9d07d95b12f32f4033fc66c8ad
- SHA512
  
  2b4e6ebc09ce19023f95523e963f121b7feacca89207fb4cc49801afae0df741965212c3cc2d06d0130c03b45dc0238f50a1115fdbafcb6c2603787c8a69fbc3
Score

10^/10

pony sality backdoor collection discovery evasion rat spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2