pony | 198d5863bd738a1ffd1ad730332f74262bb580828c72593400b81687bc6acf84

General

Target

198d5863bd738a1ffd1ad730332f74262bb580828c72593400b81687bc6acf84
Size

209KB
Sample

221125-j6ez3sgf7x
MD5

da8609c3b7f21aeed6e5fd308a387ba4
SHA1

08f9902b10ae9953e637e5639374219ec9d36689
SHA256

198d5863bd738a1ffd1ad730332f74262bb580828c72593400b81687bc6acf84
SHA512

4053b08c238936f7bddb0a498e2bed97771bc15576f8599ff7b1375c20ed769d6c3d12b295b06172ace01de784da26050cfe07b816adc4549ebd05f5eb2e13ae
SSDEEP

3072:k1C7RXcF+OcQhORvvrw8n+mnmGtyqA9cSRo0CMzFCIuIv8innax:4CdcF+JoOBrwyCsAO6ozXE1nU

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://109.120.177.164/p/gate.php

Targets

- Target
  
  198d5863bd738a1ffd1ad730332f74262bb580828c72593400b81687bc6acf84
- Size
  
  209KB
- MD5
  
  da8609c3b7f21aeed6e5fd308a387ba4
- SHA1
  
  08f9902b10ae9953e637e5639374219ec9d36689
- SHA256
  
  198d5863bd738a1ffd1ad730332f74262bb580828c72593400b81687bc6acf84
- SHA512
  
  4053b08c238936f7bddb0a498e2bed97771bc15576f8599ff7b1375c20ed769d6c3d12b295b06172ace01de784da26050cfe07b816adc4549ebd05f5eb2e13ae
- SSDEEP
  
  3072:k1C7RXcF+OcQhORvvrw8n+mnmGtyqA9cSRo0CMzFCIuIv8innax:4CdcF+JoOBrwyCsAO6ozXE1nU
Score

10^/10

pony collection discovery persistence rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2