Overview

overview

10

Static

static

10

21a14593fe...50.exe

windows7-x64

10

21a14593fe...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21a14593fe4f3466ec9840d0b0186906591bf87a9bc9fef263e71309fed0a750

  • Size

    34KB

  • Sample

    221128-e4j4ssag5v

  • MD5

    b8f01589487b8baf361b7f5e66d769a9

  • SHA1

    eb1b0dc51b09b0943bf5bfb9dd7ed2ae8dfafd4b

  • SHA256

    21a14593fe4f3466ec9840d0b0186906591bf87a9bc9fef263e71309fed0a750

  • SHA512

    9e7b52f57a82e7accb5ccbddc44264f422d9ba6acf36f67eb404632a7cda1e6f55f32c0ce2eafd18f01e21c650286064b4dd24b37aa83ac6d3c16876928d35ca

  • SSDEEP

    768:/1NAU2HFJK/ItMZalLoM2cH2LGHhQsSkfbBI:/s3fKwzLPNEGO/UbBI

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://184.105.163.235/new_advert/urwqehusd.php

Attributes
  • payload_url

    http://162.247.14.141/ff/pc.exe

    http://162.247.14.141/ff/pc2.exe

    http://162.247.14.141/ff/pc3.exe

Targets

    • Target

      21a14593fe4f3466ec9840d0b0186906591bf87a9bc9fef263e71309fed0a750

    • Size

      34KB

    • MD5

      b8f01589487b8baf361b7f5e66d769a9

    • SHA1

      eb1b0dc51b09b0943bf5bfb9dd7ed2ae8dfafd4b

    • SHA256

      21a14593fe4f3466ec9840d0b0186906591bf87a9bc9fef263e71309fed0a750

    • SHA512

      9e7b52f57a82e7accb5ccbddc44264f422d9ba6acf36f67eb404632a7cda1e6f55f32c0ce2eafd18f01e21c650286064b4dd24b37aa83ac6d3c16876928d35ca

    • SSDEEP

      768:/1NAU2HFJK/ItMZalLoM2cH2LGHhQsSkfbBI:/s3fKwzLPNEGO/UbBI

    Score
    10/10
    ponycollectiondiscoveryratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks