Overview

overview

10

Static

static

8cc614914a...3e.exe

windows7-x64

10

8cc614914a...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cc614914ae5b0fa525ebbb25abdceac061bcdd182a1eb3fd6bbc1545af1553e

  • Size

    853KB

  • Sample

    221126-e7mdbscb83

  • MD5

    031bb5e3a8a912ebe1062c11626554ef

  • SHA1

    777088c33921b36e6242ff972a7e157184cb7ff5

  • SHA256

    8cc614914ae5b0fa525ebbb25abdceac061bcdd182a1eb3fd6bbc1545af1553e

  • SHA512

    8571c313028723b2e333d433be4b0736fff189244dfed8ee3eafa2142f5edd11cdd964c149951674bbd03acb3fc9738727d6d7ed0ab49e4d468a0989118e6874

  • SSDEEP

    6144:gXN1NM84buxCdPFsaS2cDDnB743okE/iKnMcYwhPAnXV/ZFuJQeWEZ6/:W1NM0QdNpkDl2EqKXPAnXV/8Qeh

Score
10/10
ponycollectionratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://oscanpro.favcc1.com/gate.php

Targets

    • Target

      8cc614914ae5b0fa525ebbb25abdceac061bcdd182a1eb3fd6bbc1545af1553e

    • Size

      853KB

    • MD5

      031bb5e3a8a912ebe1062c11626554ef

    • SHA1

      777088c33921b36e6242ff972a7e157184cb7ff5

    • SHA256

      8cc614914ae5b0fa525ebbb25abdceac061bcdd182a1eb3fd6bbc1545af1553e

    • SHA512

      8571c313028723b2e333d433be4b0736fff189244dfed8ee3eafa2142f5edd11cdd964c149951674bbd03acb3fc9738727d6d7ed0ab49e4d468a0989118e6874

    • SSDEEP

      6144:gXN1NM84buxCdPFsaS2cDDnB743okE/iKnMcYwhPAnXV/ZFuJQeWEZ6/:W1NM0QdNpkDl2EqKXPAnXV/8Qeh

    Score
    10/10
    ponycollectionratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks