Overview

overview

10

Static

static

e4fece3c8d...3d.exe

windows7-x64

10

e4fece3c8d...3d.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4fece3c8d962a36928d9d457b4c4d7a5cb29134c7f1c57b85bd12ed9ab5b23d

  • Size

    112KB

  • Sample

    221029-1p5b3sgeg8

  • MD5

    545a54eb44f5b4f9aca5fc986c077af0

  • SHA1

    dfa1a0bd4df84709d6411f5aefe558f680527939

  • SHA256

    e4fece3c8d962a36928d9d457b4c4d7a5cb29134c7f1c57b85bd12ed9ab5b23d

  • SHA512

    180e69ffc97e7dba23e3b2cdba3ab81a5bf1a39766a45868c0a94a7fb2e398107e1b43be78a340a14caa675006892bfe557e6f84793cb119cd915679cbc8f7e0

  • SSDEEP

    3072:ZWmGsdRDqKXvf/epi701ivrMby2b3Thzgq08/y0nTrEGY:ZBDG6H/epi7eiAby2b3Th8q0860nTr

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://forum.xcpus.com:8080/forum/viewtopic.php

http://pagetengroup.com/forum/viewtopic.php

http://pas.net/forum/viewtopic.php

http://playonlinerummy.net/forum/viewtopic.php
Attributes
  • payload_url

    http://apparellogisticsgroup.net/5HvkhC.exe

    http://test.lmpferrara.com/hfpRY.exe

    http://palmsodyssey.org/GR7j.exe

    http://jumpsuit.se/K8WMa.exe

Targets

    • Target

      e4fece3c8d962a36928d9d457b4c4d7a5cb29134c7f1c57b85bd12ed9ab5b23d

    • Size

      112KB

    • MD5

      545a54eb44f5b4f9aca5fc986c077af0

    • SHA1

      dfa1a0bd4df84709d6411f5aefe558f680527939

    • SHA256

      e4fece3c8d962a36928d9d457b4c4d7a5cb29134c7f1c57b85bd12ed9ab5b23d

    • SHA512

      180e69ffc97e7dba23e3b2cdba3ab81a5bf1a39766a45868c0a94a7fb2e398107e1b43be78a340a14caa675006892bfe557e6f84793cb119cd915679cbc8f7e0

    • SSDEEP

      3072:ZWmGsdRDqKXvf/epi701ivrMby2b3Thzgq08/y0nTrEGY:ZBDG6H/epi7eiAby2b3Th8q0860nTr

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks