pony | d8f4765e0e0c32e371038daec2f0e4c30bfa905ee3a6b5a9e51cca896276546e

General

Target

d8f4765e0e0c32e371038daec2f0e4c30bfa905ee3a6b5a9e51cca896276546e
Size

141KB
Sample

221123-p7lrxadb93
MD5

47f26ca4e01f8df722f19b736d6729f6
SHA1

c24fa974637a62e07f29c0c3e469bdb54d7e41e3
SHA256

d8f4765e0e0c32e371038daec2f0e4c30bfa905ee3a6b5a9e51cca896276546e
SHA512

af5eb6a3a40159161a2e9a4c316628f5622112109e5af955d2f95f6bafc61b1a3065ea6e92f996d5b7c26446f10b73c949c3ddfed83a52e26f86ca60d8a920a3
SSDEEP

3072:BaB54+8diXhyR1FTuxCcxEyuw82jsb9om4DLJngkECPMLjjPEJm:BaBlSSyRcC45j7hgeojf

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://62.76.191.81:7623/forum/gate.php

Targets

- Target
  
  d8f4765e0e0c32e371038daec2f0e4c30bfa905ee3a6b5a9e51cca896276546e
- Size
  
  141KB
- MD5
  
  47f26ca4e01f8df722f19b736d6729f6
- SHA1
  
  c24fa974637a62e07f29c0c3e469bdb54d7e41e3
- SHA256
  
  d8f4765e0e0c32e371038daec2f0e4c30bfa905ee3a6b5a9e51cca896276546e
- SHA512
  
  af5eb6a3a40159161a2e9a4c316628f5622112109e5af955d2f95f6bafc61b1a3065ea6e92f996d5b7c26446f10b73c949c3ddfed83a52e26f86ca60d8a920a3
- SSDEEP
  
  3072:BaB54+8diXhyR1FTuxCcxEyuw82jsb9om4DLJngkECPMLjjPEJm:BaBlSSyRcC45j7hgeojf
Score

10^/10

pony collection discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

2

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2