Overview

overview

10

Static

static

5c4a3db950...b3.exe

windows7-x64

10

5c4a3db950...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c4a3db950ada109036f3512dc8e17fba1dc15d7d226bacd91f6bf0342382ab3

  • Size

    305KB

  • Sample

    221003-c1wbjscde8

  • MD5

    2ddec48c25a40ed729b266ce4148aba9

  • SHA1

    51101547eddd49f84df3010afadc1daab1bced95

  • SHA256

    5c4a3db950ada109036f3512dc8e17fba1dc15d7d226bacd91f6bf0342382ab3

  • SHA512

    20cc4ad3876dbadfb98f39d28b15cbaf8d9807563a27d85b1d2fc967ef30179edcdd602aa3c0ab0dadc5db58e06615463764adda673acaa3c240e0d6e7e2acbf

  • SSDEEP

    6144:pSLnlItahCJrxjwDyf+PzOgSV8SJiiTE:ULnm4hcrxj4PzO/u

Score
10/10
ponycollectionratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://muzukashibrashinki.net/mozie55/gate.php

Targets

    • Target

      5c4a3db950ada109036f3512dc8e17fba1dc15d7d226bacd91f6bf0342382ab3

    • Size

      305KB

    • MD5

      2ddec48c25a40ed729b266ce4148aba9

    • SHA1

      51101547eddd49f84df3010afadc1daab1bced95

    • SHA256

      5c4a3db950ada109036f3512dc8e17fba1dc15d7d226bacd91f6bf0342382ab3

    • SHA512

      20cc4ad3876dbadfb98f39d28b15cbaf8d9807563a27d85b1d2fc967ef30179edcdd602aa3c0ab0dadc5db58e06615463764adda673acaa3c240e0d6e7e2acbf

    • SSDEEP

      6144:pSLnlItahCJrxjwDyf+PzOgSV8SJiiTE:ULnm4hcrxj4PzO/u

    Score
    10/10
    ponycollectionratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks