Overview

overview

10

Static

static

2c25f55056...7a.exe

windows7-x64

10

2c25f55056...7a.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c25f5505694e5dc159b26cc2f0702d5ef36014349d0fdba2e0e05ba2ee33a7a

  • Size

    118KB

  • Sample

    221002-q8g1sabbdk

  • MD5

    640c9a234747894f7fbc790991b37920

  • SHA1

    825b9500fb590a3941b005b5068cdea2da424f16

  • SHA256

    2c25f5505694e5dc159b26cc2f0702d5ef36014349d0fdba2e0e05ba2ee33a7a

  • SHA512

    0f2390ca1e1a193ef2b74dccd20de1677cd50b12e3cd97f3dc595f72d2e97f5d46fc590555257e9272ea647f88b042975c1b9c6d3cb12121e0c22c6e74789c13

  • SSDEEP

    3072:czCCvj5MzJrFuuvioB0IGgv3R2PB7Gk4BU1/pPUcbnF9M34:WvUR9ugvS7GvIpXbnF9MI

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://jerrigibsonmccloud.com/forum/viewtopic.php

http://rivercrossingaptstx.com/forum/viewtopic.php

http://rivercrossingaptstx.info/forum/viewtopic.php

http://y2k-usa.com/forum/viewtopic.php
Attributes
  • payload_url

    http://www.mbbd.it/4zZ.exe

    http://win.centrostudiathena.com/32qr.exe

    http://laimages.net/UwZjWM8.exe

    http://grandns.net/WFHqQ0t1.exe

Targets

    • Target

      2c25f5505694e5dc159b26cc2f0702d5ef36014349d0fdba2e0e05ba2ee33a7a

    • Size

      118KB

    • MD5

      640c9a234747894f7fbc790991b37920

    • SHA1

      825b9500fb590a3941b005b5068cdea2da424f16

    • SHA256

      2c25f5505694e5dc159b26cc2f0702d5ef36014349d0fdba2e0e05ba2ee33a7a

    • SHA512

      0f2390ca1e1a193ef2b74dccd20de1677cd50b12e3cd97f3dc595f72d2e97f5d46fc590555257e9272ea647f88b042975c1b9c6d3cb12121e0c22c6e74789c13

    • SSDEEP

      3072:czCCvj5MzJrFuuvioB0IGgv3R2PB7Gk4BU1/pPUcbnF9M34:WvUR9ugvS7GvIpXbnF9MI

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks