Overview

overview

10

Static

static

2587f394c4...70.exe

windows7-x64

10

2587f394c4...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2587f394c485ab31f8f04fd627da20884019980055de1a949147a6af28b13170

  • Size

    88KB

  • Sample

    221002-lrg71ahgh9

  • MD5

    65cac1988793cbffda3ad67b065cade0

  • SHA1

    b5711cad13bd7d22444a74e78ff5d05d363d2d97

  • SHA256

    2587f394c485ab31f8f04fd627da20884019980055de1a949147a6af28b13170

  • SHA512

    7172495113c311a55cae793de701baa345d627705db9a797fbb576b05cbb519d368413d65a8220aea6fc536a7f3315c48b39b746e707f97d69339f812d9f3797

  • SSDEEP

    1536:29aTff+Vt58Nir18lhGm8BuMyZTPjvcVuL1AzrSMVx55ZS+G8USRlE4O3zzmOEC1:2gf+8iZCGWMejLcVmYrSexTjr1RK3nmy

Score
10/10
ponycollectionpersistenceratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://podaro-vk.esy.es/gate.php

Targets

    • Target

      2587f394c485ab31f8f04fd627da20884019980055de1a949147a6af28b13170

    • Size

      88KB

    • MD5

      65cac1988793cbffda3ad67b065cade0

    • SHA1

      b5711cad13bd7d22444a74e78ff5d05d363d2d97

    • SHA256

      2587f394c485ab31f8f04fd627da20884019980055de1a949147a6af28b13170

    • SHA512

      7172495113c311a55cae793de701baa345d627705db9a797fbb576b05cbb519d368413d65a8220aea6fc536a7f3315c48b39b746e707f97d69339f812d9f3797

    • SSDEEP

      1536:29aTff+Vt58Nir18lhGm8BuMyZTPjvcVuL1AzrSMVx55ZS+G8USRlE4O3zzmOEC1:2gf+8iZCGWMejLcVmYrSexTjr1RK3nmy

    Score
    10/10
    ponycollectionpersistenceratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks