Overview

overview

10

Static

static

4b626a59d1...81.exe

windows7-x64

10

4b626a59d1...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b626a59d14dbe95119026551baefbae10d497447a56e636f08077716ea1ef81

  • Size

    148KB

  • Sample

    221128-k7zljsgc3z

  • MD5

    167e0ab6edf231b2fa3687948a3b606d

  • SHA1

    11921e91a6a387c250576eaaa62713211b88f5f5

  • SHA256

    4b626a59d14dbe95119026551baefbae10d497447a56e636f08077716ea1ef81

  • SHA512

    02d9e3fcdbe0dd548ceed80aec1146e7d9cfba06663623ae1c7f04f566cd372d7513ef0c45e23bd45b56b7e5e5e23614bc20b7faea7a14838f75e9ecbdb7e2fd

  • SSDEEP

    3072:gEA/WHMUt+EW2Jxoa+5WqS6ZpUsFTtxrcmwpiveH/7MckAs:gLg7jA3U0IfpjTkA

Score
10/10
ponycollectionratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://sweet0rium.com/dd/Panel/gate.php

http://www.sweet0rium.com/dd/Panel/gate.php

Targets

    • Target

      4b626a59d14dbe95119026551baefbae10d497447a56e636f08077716ea1ef81

    • Size

      148KB

    • MD5

      167e0ab6edf231b2fa3687948a3b606d

    • SHA1

      11921e91a6a387c250576eaaa62713211b88f5f5

    • SHA256

      4b626a59d14dbe95119026551baefbae10d497447a56e636f08077716ea1ef81

    • SHA512

      02d9e3fcdbe0dd548ceed80aec1146e7d9cfba06663623ae1c7f04f566cd372d7513ef0c45e23bd45b56b7e5e5e23614bc20b7faea7a14838f75e9ecbdb7e2fd

    • SSDEEP

      3072:gEA/WHMUt+EW2Jxoa+5WqS6ZpUsFTtxrcmwpiveH/7MckAs:gLg7jA3U0IfpjTkA

    Score
    10/10
    ponycollectionratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks