Overview

overview

10

Static

static

10

b2d799373c...f4.exe

windows7-x64

10

b2d799373c...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2d799373c2f100b528569b95da19f46082874a84a92a6ad4f4338bac50077f4

  • Size

    89KB

  • Sample

    221002-2xjk1sffgr

  • MD5

    00408023c64fe37809a27febe8106366

  • SHA1

    3b5bcee7123ace7a8622c4b13e588efca8cd0b5c

  • SHA256

    b2d799373c2f100b528569b95da19f46082874a84a92a6ad4f4338bac50077f4

  • SHA512

    d9a013a737555055021603bfafac4b2d7d303d58386a111764d11e7f83b86db6ebc8e5398e9653332a8dd8b1248fb02b4a5948b0a27d021920e65af2db13ec40

  • SSDEEP

    1536:Tbb3gvnF6qTQNd2xk6phMfksDuiene4jqOvwsKTvME4EkzZn:vTQFdxk6TMffveSOvB/E43n

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://zero.axellelemaire2012.org/forum/viewtopic.php

http://q.e-tecinnovation.co.uk/forum/viewtopic.php
Attributes
  • payload_url

    http://pluto3d.com/b0tTMudd/dJZ0exf.exe

    http://184.107.222.147/crTWwNz7/M4AKBj.exe

    http://penacad.com/Eqr6LxF3/oGN.exe

    http://www.good-ideas.com.ar/u35ziSM1/hK2E.exe

    http://homesteadhospice.net/Li9L0sN7/BpJ.exe

Targets

    • Target

      b2d799373c2f100b528569b95da19f46082874a84a92a6ad4f4338bac50077f4

    • Size

      89KB

    • MD5

      00408023c64fe37809a27febe8106366

    • SHA1

      3b5bcee7123ace7a8622c4b13e588efca8cd0b5c

    • SHA256

      b2d799373c2f100b528569b95da19f46082874a84a92a6ad4f4338bac50077f4

    • SHA512

      d9a013a737555055021603bfafac4b2d7d303d58386a111764d11e7f83b86db6ebc8e5398e9653332a8dd8b1248fb02b4a5948b0a27d021920e65af2db13ec40

    • SSDEEP

      1536:Tbb3gvnF6qTQNd2xk6phMfksDuiene4jqOvwsKTvME4EkzZn:vTQFdxk6TMffveSOvB/E43n

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks