pony | 67cf9d92ba34b560f348146c8e05729f00d55468ce6c97910f59b246054cf47e

General

Target

67cf9d92ba34b560f348146c8e05729f00d55468ce6c97910f59b246054cf47e
Size

147KB
Sample

221123-s4smtsda64
MD5

630e8d3ba621596560ffbf0633102ba7
SHA1

62bb6d36401bf215028ddefb80a10f9f1a102957
SHA256

67cf9d92ba34b560f348146c8e05729f00d55468ce6c97910f59b246054cf47e
SHA512

663cb02e63facd7e417f218bb12bb0988768f2418c22736ae4b41b591a6828dc695c8f4b880bd3c9f240e05bd5feddf980dd2e1825e2352f403cf1147fea7015
SSDEEP

3072:IB7bgimU4VStD9gysbJLulP8R7fzKyjCmBcvSCOBMzkvgoYku22O:Ef4PbJqkR7f5SSpKo1vb

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://sekkyspamz.favcc1.com/gate.php

Attributes

payload_url
http://sekkyspamz.favcc1.com/shit.exe

Targets

- Target
  
  67cf9d92ba34b560f348146c8e05729f00d55468ce6c97910f59b246054cf47e
- Size
  
  147KB
- MD5
  
  630e8d3ba621596560ffbf0633102ba7
- SHA1
  
  62bb6d36401bf215028ddefb80a10f9f1a102957
- SHA256
  
  67cf9d92ba34b560f348146c8e05729f00d55468ce6c97910f59b246054cf47e
- SHA512
  
  663cb02e63facd7e417f218bb12bb0988768f2418c22736ae4b41b591a6828dc695c8f4b880bd3c9f240e05bd5feddf980dd2e1825e2352f403cf1147fea7015
- SSDEEP
  
  3072:IB7bgimU4VStD9gysbJLulP8R7fzKyjCmBcvSCOBMzkvgoYku22O:Ef4PbJqkR7f5SSpKo1vb
Score

10^/10

pony collection rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

2

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

UPX packed file

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2