Overview

overview

10

Static

static

b485ac7ae1...15.exe

windows7-x64

10

b485ac7ae1...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b485ac7ae1e0aa01dcc7e92d29748427bde01341b24d230c85920c2bc19b9615

  • Size

    240KB

  • Sample

    221003-a5gb3sbabn

  • MD5

    079b57aa8475c3f0eedfa6bdd37622f2

  • SHA1

    1dbfc3a42e56d0fb2172cfe6d217ab2a2fb62a1c

  • SHA256

    b485ac7ae1e0aa01dcc7e92d29748427bde01341b24d230c85920c2bc19b9615

  • SHA512

    13b8ed4ede8ed8e9fa9f8e9073ee2694955082b38b9f98f9cf2024a766588d07aad3c1c28e2618b916eef931ec87a431c32d1041058df297c07522286e0328f7

  • SSDEEP

    3072:LDuHd+nwa/M2n7Q+ERjghNjtT3Zu9nSS1k7kCkg8IydvFTcvyo:LyHSwab7Q+wkPtT3ZeSS1kuIydvZc7

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Targets

    • Target

      b485ac7ae1e0aa01dcc7e92d29748427bde01341b24d230c85920c2bc19b9615

    • Size

      240KB

    • MD5

      079b57aa8475c3f0eedfa6bdd37622f2

    • SHA1

      1dbfc3a42e56d0fb2172cfe6d217ab2a2fb62a1c

    • SHA256

      b485ac7ae1e0aa01dcc7e92d29748427bde01341b24d230c85920c2bc19b9615

    • SHA512

      13b8ed4ede8ed8e9fa9f8e9073ee2694955082b38b9f98f9cf2024a766588d07aad3c1c28e2618b916eef931ec87a431c32d1041058df297c07522286e0328f7

    • SSDEEP

      3072:LDuHd+nwa/M2n7Q+ERjghNjtT3Zu9nSS1k7kCkg8IydvFTcvyo:LyHSwab7Q+wkPtT3ZeSS1kuIydvZc7

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks