pony | 882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334

General

Target

882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334
Size

99KB
Sample

221002-3nkx6affb5
MD5

d1a234d57417fa05184a02e6bc11ffed
SHA1

08e1f9de78b90991c700a443b523ac144dbfe8c1
SHA256

882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334
SHA512

de7f658fa4b79bc52326677a13245c0e4254fbbbf8384e9e7b6dd069e70c1f6d4ea015c437943a6e8ca114f90c62aa9f10050bf99eb11071a976e1dc4edf962d
SSDEEP

1536:Z+XEKahQRDNUaNCP2xpcmYRO4JcgxMfyEpa2LTBFH1oDB/d1+Jx9apSFVq/duBAr:Z+UKaehNyaWTBmtL2t+4pMGdbgkE+

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://www.arki.com:8080/ponyb/gate.php

http://arki.com:8080/ponyb/gate.php

http://50.57.185.72:8080/ponyb/gate.php

http://drrtkumarpainmanagement.com/ponyb/gate.php

Attributes

payload_url
http://mganalyticsllc.com/aPybXeim.exe

http://www.efg-bethel.de/PPBB.exe

http://purnadisha.com/58RddWuR.exe

http://scabogados.mx/idGqasC4.exe

Targets

- Target
  
  WF_Docs_6082013.exe
- Size
  
  119KB
- MD5
  
  27dcad6488ce8bcb8e0bfc46bacec11f
- SHA1
  
  3c77fc685cc981635aaa92727648441df7c64a1b
- SHA256
  
  4ed62b0892442040e5264887d2800669ef47e756ba16068c60d1448933a208c7
- SHA512
  
  9c2972ea80bd7c6f0aa3c07977a1de0f210ea14b7cc832667df5c103d34de9ad4d6bb9741abac67c195180bfa55996f282c293a7097d74bb4a2546d576206d56
- SSDEEP
  
  1536:wAk/EDNZV9SVmXdLv1znNGdEewelt8sJWROzxK8b576UZzUGh/PKltxQVH6R4tAI:wcO6dLv1z4dEetlaswSVb1xBtPUmH6W
Score

10^/10

pony collection discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2