Overview

overview

10

Static

static

2714ed4fbf...7b.exe

windows7-x64

10

2714ed4fbf...7b.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2714ed4fbf9e6dfafba6ce1536e738c5b603be95569121b25d17f163ce4c227b

  • Size

    130KB

  • Sample

    221001-2xqpbsbab7

  • MD5

    6121fe9e5790b26d636133dea102bc80

  • SHA1

    7744163bf3c94ad3a67030691321341ab7947932

  • SHA256

    2714ed4fbf9e6dfafba6ce1536e738c5b603be95569121b25d17f163ce4c227b

  • SHA512

    6ccb2fd4780de7d4e71e89cc0f3a3ced1ded9297244a8a3d1feb448dac2a2abacc87c2258e3221f648b9e858a629b91a2cb524aac4da5bc6211d91936aa0a4a0

  • SSDEEP

    3072:HapuetxQU7WD0jWGkYC3l2FRby8kX/LPr5hqLaCTv2:He7tMGWZroazX5huaCr2

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://mail.yaklasim.com:8080/forum/viewtopic.php

http://116.122.158.195:8080/forum/viewtopic.php

http://buycoopertires.com/forum/viewtopic.php

http://buycoopertires.info/forum/viewtopic.php
Attributes
  • payload_url

    http://dkkg.de/RXmc.exe

    http://khnautomationsystems.com/GSFjGSu.exe

    http://61.64.96.64/vcFRm.exe

    http://ftp.adaro.sk/yJkedZ.exe

Targets

    • Target

      2714ed4fbf9e6dfafba6ce1536e738c5b603be95569121b25d17f163ce4c227b

    • Size

      130KB

    • MD5

      6121fe9e5790b26d636133dea102bc80

    • SHA1

      7744163bf3c94ad3a67030691321341ab7947932

    • SHA256

      2714ed4fbf9e6dfafba6ce1536e738c5b603be95569121b25d17f163ce4c227b

    • SHA512

      6ccb2fd4780de7d4e71e89cc0f3a3ced1ded9297244a8a3d1feb448dac2a2abacc87c2258e3221f648b9e858a629b91a2cb524aac4da5bc6211d91936aa0a4a0

    • SSDEEP

      3072:HapuetxQU7WD0jWGkYC3l2FRby8kX/LPr5hqLaCTv2:He7tMGWZroazX5huaCr2

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks