Overview

overview

10

Static

static

705b871353...55.exe

windows7-x64

10

705b871353...55.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    705b87135360eff68c37340dfd988ececc347afa2dc973bfadbd37cc85bb0e55

  • Size

    114KB

  • Sample

    221011-jcf1aacdcl

  • MD5

    6948d3744721637c1a3bd756d7818120

  • SHA1

    93055333f161184af7870674f039cb7e7f7af3a8

  • SHA256

    705b87135360eff68c37340dfd988ececc347afa2dc973bfadbd37cc85bb0e55

  • SHA512

    2ddb3c42d4c0b3c2c3a707025471815e17ccdd06f9bddf5b48d34d60de089617ac0c8875a9cf5c490be7a4f05bf5253a75e4e5b56cfa857d3c42b83ebfc2df4a

  • SSDEEP

    1536:+zsXO9dJE4H+/PtQCzQZGPo7k51W2+W+KtKNM0hZA/IupYyKg6Ik7oSpup2WDSHk:+zsXsm/Ptxxo70+pM9PpJKFqp+HL1q

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://novafitnesstrainer.com/ponyb/gate.php

http://rippedtrainer.com/ponyb/gate.php

http://subprimemortgage.us/ponyb/gate.php

http://inflectionism.com/ponyb/gate.php
Attributes
  • payload_url

    http://gaiahpl.com/QQuAzs.exe

    http://kandu.de/7qW5tXSm.exe

    http://s252653471.onlinehome.us/SPJYZe.exe

Targets

    • Target

      705b87135360eff68c37340dfd988ececc347afa2dc973bfadbd37cc85bb0e55

    • Size

      114KB

    • MD5

      6948d3744721637c1a3bd756d7818120

    • SHA1

      93055333f161184af7870674f039cb7e7f7af3a8

    • SHA256

      705b87135360eff68c37340dfd988ececc347afa2dc973bfadbd37cc85bb0e55

    • SHA512

      2ddb3c42d4c0b3c2c3a707025471815e17ccdd06f9bddf5b48d34d60de089617ac0c8875a9cf5c490be7a4f05bf5253a75e4e5b56cfa857d3c42b83ebfc2df4a

    • SSDEEP

      1536:+zsXO9dJE4H+/PtQCzQZGPo7k51W2+W+KtKNM0hZA/IupYyKg6Ik7oSpup2WDSHk:+zsXsm/Ptxxo70+pM9PpJKFqp+HL1q

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks