pony | f1097b7811a7408b8e1f2d55d1c52b686b2a8172c79a66159a8e8c523ab86d19

General

Target

f1097b7811a7408b8e1f2d55d1c52b686b2a8172c79a66159a8e8c523ab86d19
Size

99KB
Sample

221003-qde8psgfb7
MD5

6a235847ab737a0356afbe1399baac70
SHA1

7fc53734d68bccdc3a6c821817669df0ee4ec0dd
SHA256

f1097b7811a7408b8e1f2d55d1c52b686b2a8172c79a66159a8e8c523ab86d19
SHA512

1fc1796c827a0983d8a990df0080b0f4197e8d89dda72034d4804c786100faa1b58554f8d54d278bd149e6507e8999d041899a8a7e017077b2708c5d926e3bf3
SSDEEP

1536:YvMB07S+2leDqugrvI0xzSudIwiHyOguhRN2hGK0oULConk/WhcTM:QuFle2uovPiHHYmRpWUGChL

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://securityspecialiastinc.in/p/gate.php

Attributes

payload_url
http://securityspecialiastinc.in/p/p.exe

Targets

- Target
  
  f1097b7811a7408b8e1f2d55d1c52b686b2a8172c79a66159a8e8c523ab86d19
- Size
  
  99KB
- MD5
  
  6a235847ab737a0356afbe1399baac70
- SHA1
  
  7fc53734d68bccdc3a6c821817669df0ee4ec0dd
- SHA256
  
  f1097b7811a7408b8e1f2d55d1c52b686b2a8172c79a66159a8e8c523ab86d19
- SHA512
  
  1fc1796c827a0983d8a990df0080b0f4197e8d89dda72034d4804c786100faa1b58554f8d54d278bd149e6507e8999d041899a8a7e017077b2708c5d926e3bf3
- SSDEEP
  
  1536:YvMB07S+2leDqugrvI0xzSudIwiHyOguhRN2hGK0oULConk/WhcTM:QuFle2uovPiHHYmRpWUGChL
Score

10^/10

pony collection discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

2

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

UPX packed file

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2