Overview

overview

10

Static

static

Trojan-Ran...nt.exe

windows7-x64

10

Trojan-Ran...nt.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Trojan-Ransom.Win32.Agent.hsk-0af8c214655dad73fc69dff24c903d2845838d908ca52e84c054f23300da0297

  • Size

    111KB

  • Sample

    221106-pzxjfaecdq

  • MD5

    a18472344f4cd15da2a7880dbb62e14d

  • SHA1

    931cf8f219215b5695570c2aa6e411ffccf5aa65

  • SHA256

    0af8c214655dad73fc69dff24c903d2845838d908ca52e84c054f23300da0297

  • SHA512

    bffe2e1cfeb63d658f7e620504b3ee88430578958d5f230384c13286647974523d2978e5bd6105c2fe500827c7377bf826d895a33ff9175190e4dbed5efbf748

  • SSDEEP

    3072:pNX+fXO7TBhwiio+YiPyeyMai2GAY9NqXZg:rX+fe7Hw63iq/MarVyNV

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://13.carnovirious.net/forum/viewtopic.php

http://13.JONEMNOMINIK.NET/forum/viewtopic.php

http://13.LOMERDASTER.NET/forum/viewtopic.php

http://13.ZABAKARVESTER.NET/forum/viewtopic.php
Attributes
  • payload_url

    http://www.itopservices.it/Ntx.exe

    http://faulpelz.ch/nnARS1b.exe

    http://wabsolutely.com/Egyo6cV.exe

    http://canadianposcorp.com/Zje.exe

    http://schenkelbot.com/hwk40m.exe

    http://ftp.institutodedesarrollo.es/kvWcmHRw.exe

Targets

    • Target

      Trojan-Ransom.Win32.Agent.hsk-0af8c214655dad73fc69dff24c903d2845838d908ca52e84c054f23300da0297

    • Size

      111KB

    • MD5

      a18472344f4cd15da2a7880dbb62e14d

    • SHA1

      931cf8f219215b5695570c2aa6e411ffccf5aa65

    • SHA256

      0af8c214655dad73fc69dff24c903d2845838d908ca52e84c054f23300da0297

    • SHA512

      bffe2e1cfeb63d658f7e620504b3ee88430578958d5f230384c13286647974523d2978e5bd6105c2fe500827c7377bf826d895a33ff9175190e4dbed5efbf748

    • SSDEEP

      3072:pNX+fXO7TBhwiio+YiPyeyMai2GAY9NqXZg:rX+fe7Hw63iq/MarVyNV

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks