Overview

overview

10

Static

static

7b5d06381e...c1.exe

windows7-x64

10

7b5d06381e...c1.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b5d06381e3a6f5a056c92ce63656400f4d4d70bdd9db6759b653ad13c9641c1

  • Size

    118KB

  • Sample

    221001-2hphqabeep

  • MD5

    6f8ff0b6b8e13b5c8ba024cf08431272

  • SHA1

    d27f9580a4582190cebec7b01f55334c7afad8f8

  • SHA256

    7b5d06381e3a6f5a056c92ce63656400f4d4d70bdd9db6759b653ad13c9641c1

  • SHA512

    420f340bc71680bac62cb9c51ad0a23978827b8e6db6a5b64483f5c00e50c436a6e181e1ba8ffb1c65b1481528305101928a5c8e9d7f9e13fef21bebe206deb2

  • SSDEEP

    3072:mYmGR8uiPFOPcoKIb0G3MCpTuWNyUYxL/nD14tL:mYZR8ui9O5D3xpTFyU4LfD1a

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://forum.xcpus.com:8080/ponyz/gate.php

http://ccrtl.com/ponyz/gate.php

http://chrisandannwedding.com/ponyz/gate.php

http://chriscarlson.com/ponyz/gate.php
Attributes
  • payload_url

    http://ftp.lithotipiki.gr/6i7Kec.exe

    http://workingschool.dk/Ndq.exe

    http://www.salus626.it/yz7Yu.exe

Targets

    • Target

      7b5d06381e3a6f5a056c92ce63656400f4d4d70bdd9db6759b653ad13c9641c1

    • Size

      118KB

    • MD5

      6f8ff0b6b8e13b5c8ba024cf08431272

    • SHA1

      d27f9580a4582190cebec7b01f55334c7afad8f8

    • SHA256

      7b5d06381e3a6f5a056c92ce63656400f4d4d70bdd9db6759b653ad13c9641c1

    • SHA512

      420f340bc71680bac62cb9c51ad0a23978827b8e6db6a5b64483f5c00e50c436a6e181e1ba8ffb1c65b1481528305101928a5c8e9d7f9e13fef21bebe206deb2

    • SSDEEP

      3072:mYmGR8uiPFOPcoKIb0G3MCpTuWNyUYxL/nD14tL:mYZR8ui9O5D3xpTFyU4LfD1a

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks