pony | 2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0

General

Target

2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0
Size

272KB
Sample

221127-wk2yyabg2y
MD5

310d66d4488e4fd0e978c3e85973a308
SHA1

a25dfe830e1611f1eb8870a941a560c315db8fdc
SHA256

2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0
SHA512

3cb1cbef871dab640913a9bd7d9bdf5c85a91c9c5b9ce0844064ae8bf6c618c2320e2f57ad7a71424adafa43cbba1e08b42fa8c93bbd21422c3bf4d54b3659bb
SSDEEP

6144:9x5ZY0h2Bg8WNo+Ik/P/Godl8BwYf4Nnpwp2uWDBJJ3UWQi:nbYQ2ByC2H/Gob8iY6pC2u0Bvd

Score

10^/10

Malware Config

Targets

- Target
  
  2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0
- Size
  
  272KB
- MD5
  
  310d66d4488e4fd0e978c3e85973a308
- SHA1
  
  a25dfe830e1611f1eb8870a941a560c315db8fdc
- SHA256
  
  2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0
- SHA512
  
  3cb1cbef871dab640913a9bd7d9bdf5c85a91c9c5b9ce0844064ae8bf6c618c2320e2f57ad7a71424adafa43cbba1e08b42fa8c93bbd21422c3bf4d54b3659bb
- SSDEEP
  
  6144:9x5ZY0h2Bg8WNo+Ik/P/Godl8BwYf4Nnpwp2uWDBJJ3UWQi:nbYQ2ByC2H/Gob8iY6pC2u0Bvd
Score

10^/10

pony discovery evasion persistence rat spyware stealer upx
- Modifies security service
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2