Overview

overview

10

Static

static

d34097d6a8...19.exe

windows7-x64

10

d34097d6a8...19.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d34097d6a85a8dad6844216134eb6e04eb334d6fb90e225f2b57c46d10a9ef19

  • Size

    133KB

  • Sample

    221001-14a2saheh3

  • MD5

    6248b9ef663510bb74ed6d087c824700

  • SHA1

    a8dc18d9d9eba180336afa78774e149bd858a2d6

  • SHA256

    d34097d6a85a8dad6844216134eb6e04eb334d6fb90e225f2b57c46d10a9ef19

  • SHA512

    05908c5b33d7cd7142983d30c1c8958b1284081f2e6911a72ad570fb92d42005ae6f7ec1c0bdc8ed1dbf2167859af36d2da017879ab4a7e9c2baff3131219f2e

  • SSDEEP

    3072:NERHOFCjvLQJ+NnOoEXLTvknwwu3Fc+Vu5eoaB9qY:QH/S+NOoG9VFVu5eo6

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://116.122.158.195:8080/ponyz/gate.php

http://mail.yaklasim.com:8080/ponyz/gate.php

http://stopbreathingwhilesleeping.com/ponyz/gate.php

http://thesavingauthority.com/ponyz/gate.php
Attributes
  • payload_url

    http://birth-defect-drug-lawyers.com/ADnUUr6N.exe

    http://connect-me.de/q2M.exe

    http://energeiakikatoikia.gr/RZCb.exe

Targets

    • Target

      d34097d6a85a8dad6844216134eb6e04eb334d6fb90e225f2b57c46d10a9ef19

    • Size

      133KB

    • MD5

      6248b9ef663510bb74ed6d087c824700

    • SHA1

      a8dc18d9d9eba180336afa78774e149bd858a2d6

    • SHA256

      d34097d6a85a8dad6844216134eb6e04eb334d6fb90e225f2b57c46d10a9ef19

    • SHA512

      05908c5b33d7cd7142983d30c1c8958b1284081f2e6911a72ad570fb92d42005ae6f7ec1c0bdc8ed1dbf2167859af36d2da017879ab4a7e9c2baff3131219f2e

    • SSDEEP

      3072:NERHOFCjvLQJ+NnOoEXLTvknwwu3Fc+Vu5eoaB9qY:QH/S+NOoG9VFVu5eo6

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks