Overview

overview

10

Static

static

a0adc79090...65.exe

windows7-x64

10

a0adc79090...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0adc790907eb9deaa6eee79194386aeaa5b05917b38ea48e70148f6379d3465

  • Size

    327KB

  • Sample

    221126-fg4qcsda27

  • MD5

    4943388126d9d718ebde510c47c60642

  • SHA1

    3b94eda32cec5981cf4d2e5c6d924a3119f7075e

  • SHA256

    a0adc790907eb9deaa6eee79194386aeaa5b05917b38ea48e70148f6379d3465

  • SHA512

    33437912eef5d5b838b5664c76d8c014a5d58f1dfd8f8eeca9e1549c58ec53e34e645ce73903608d7e2823014931751bbf82e7d04ef4eaa63766a14f08f5b6b1

  • SSDEEP

    6144:dUrqA3AheuswyPnJ5ejM6bfx8/6AwUSj9:dUWA3AheuswysJ8/xwU29

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://uche.fh2web.com/secure/secure.php

Targets

    • Target

      a0adc790907eb9deaa6eee79194386aeaa5b05917b38ea48e70148f6379d3465

    • Size

      327KB

    • MD5

      4943388126d9d718ebde510c47c60642

    • SHA1

      3b94eda32cec5981cf4d2e5c6d924a3119f7075e

    • SHA256

      a0adc790907eb9deaa6eee79194386aeaa5b05917b38ea48e70148f6379d3465

    • SHA512

      33437912eef5d5b838b5664c76d8c014a5d58f1dfd8f8eeca9e1549c58ec53e34e645ce73903608d7e2823014931751bbf82e7d04ef4eaa63766a14f08f5b6b1

    • SSDEEP

      6144:dUrqA3AheuswyPnJ5ejM6bfx8/6AwUSj9:dUWA3AheuswysJ8/xwU29

    Score
    10/10
    ponycollectiondiscoveryratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks