Overview

overview

10

Static

static

d6709e1925...ee.exe

windows7-x64

10

d6709e1925...ee.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6709e1925b176764014cfb93504d0e33073caaf08d62c58a97ef369049853ee

  • Size

    118KB

  • Sample

    221002-pbgs3seda4

  • MD5

    6f3bd8758460539dac5c7fb9e4b8fc00

  • SHA1

    9eaf273d064d482d58dd5af6bab7b757e09cd390

  • SHA256

    d6709e1925b176764014cfb93504d0e33073caaf08d62c58a97ef369049853ee

  • SHA512

    dc4b90e7ce8b88e2f207990b82e79a6c2405cdd6e2dbd9d95fc173626510e198ab5544d3dfcdb288768df4c97f426b3bc3f2c0ab5488fee931b81a52033ac68c

  • SSDEEP

    3072:924T4vvchF8PEviv60ORvzGu+LxEBaUry1z8pdV4mA67YlfU5:UDWFZiCutQpW6cls5

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://tmginsurance.org/ponyz/gate.php

http://supportquilting.com/ponyz/gate.php

http://eaglebay-eb5.com/ponyz/gate.php

http://eaglebay5.com/ponyz/gate.php
Attributes
  • payload_url

    http://ftp.lithotipiki.gr/6i7Kec.exe

    http://workingschool.dk/Ndq.exe

    http://ray.tc/83s.exe

Targets

    • Target

      d6709e1925b176764014cfb93504d0e33073caaf08d62c58a97ef369049853ee

    • Size

      118KB

    • MD5

      6f3bd8758460539dac5c7fb9e4b8fc00

    • SHA1

      9eaf273d064d482d58dd5af6bab7b757e09cd390

    • SHA256

      d6709e1925b176764014cfb93504d0e33073caaf08d62c58a97ef369049853ee

    • SHA512

      dc4b90e7ce8b88e2f207990b82e79a6c2405cdd6e2dbd9d95fc173626510e198ab5544d3dfcdb288768df4c97f426b3bc3f2c0ab5488fee931b81a52033ac68c

    • SSDEEP

      3072:924T4vvchF8PEviv60ORvzGu+LxEBaUry1z8pdV4mA67YlfU5:UDWFZiCutQpW6cls5

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks