Overview

overview

10

Static

static

1d6a71703b...43.exe

windows7-x64

10

1d6a71703b...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543

  • Size

    123KB

  • Sample

    221125-z4y8yaff42

  • MD5

    cfc7b9dff5ce62a12e31457d974e5618

  • SHA1

    7cc2c289249a20b3721f3cfa6fda392fb5ea4acc

  • SHA256

    1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543

  • SHA512

    78086c5542d905b837d17028a1af2acee78c68021b93fb1cac3d0f5bfd1a812d01a37485e3fa85ad2de5d0ee6921388c519b18408f0cdac6ef3b54852a01bde9

  • SSDEEP

    1536:rzqcjXrsXKrOUgDcqIunaRRyS8G+mt1ZFZ2EVA6UwUXSC9fDoQSjWv28fkrcNg17:rRGRjPPob+k1G6UNicYWl6

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://biogenx.net:8080/forum/viewtopic.php

http://datingandfriendfinder.net:8080/forum/viewtopic.php

http://116.122.158.195:8080/forum/viewtopic.php

http://siteseoguide.com:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://www.serumx.com.tr/g3Asmrw.exe

    http://kgori.co.za/6dne5e.exe

    http://aecon.gr/mw3rhpQ2.exe

Targets

    • Target

      1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543

    • Size

      123KB

    • MD5

      cfc7b9dff5ce62a12e31457d974e5618

    • SHA1

      7cc2c289249a20b3721f3cfa6fda392fb5ea4acc

    • SHA256

      1d6a71703bf089f59dc56ae9248b09264b56b088b049f3988dfc7fba65eac543

    • SHA512

      78086c5542d905b837d17028a1af2acee78c68021b93fb1cac3d0f5bfd1a812d01a37485e3fa85ad2de5d0ee6921388c519b18408f0cdac6ef3b54852a01bde9

    • SSDEEP

      1536:rzqcjXrsXKrOUgDcqIunaRRyS8G+mt1ZFZ2EVA6UwUXSC9fDoQSjWv28fkrcNg17:rRGRjPPob+k1G6UNicYWl6

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks