cobaltstrike | 92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4 | Triage

Sharing

General

Target

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
Size

144KB
Sample

221129-f17w5ach4s
MD5

e6b72ed2d3eeb2253f8bc0fce84b7183
SHA1

00c128accb19f52e36d21ced61309a602e55b471
SHA256

92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
SHA512

d8efd5bae815cb83f9d6de5339a635794260da5f8be03251ceb6be2cc463e4cf9285cd40e14186ef63089f6397f328d30e15c3034f176d652c37705277f4a826
SSDEEP

3072:oDZaZeFbifra36ZbYNgLV3XJBbKuMHiJgpaJIK0rvox2qUQ:wgeYa3UbYuFPbUJaYrE

Score

10^/10

cobaltstrike pony backdoor rat spyware stealer trojan

Malware Config

Extracted

Family

pony

C2

http://74.53.97.66:8080/forum/viewtopic.php

http://74.53.97.67:8080/forum/viewtopic.php

Attributes

payload_url
http://www.selfdefensesuperstore.com/ifWSX.exe

http://sierratroutmagnet.com/QkaK.exe

http://www.joserrago.com/WF2oWtq.exe

Targets

- Target
  
  92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
- Size
  
  144KB
- MD5
  
  e6b72ed2d3eeb2253f8bc0fce84b7183
- SHA1
  
  00c128accb19f52e36d21ced61309a602e55b471
- SHA256
  
  92530b87947a97a2ac8f5431467369ba1427a448708fdc9f7e15afb61fd796e4
- SHA512
  
  d8efd5bae815cb83f9d6de5339a635794260da5f8be03251ceb6be2cc463e4cf9285cd40e14186ef63089f6397f328d30e15c3034f176d652c37705277f4a826
- SSDEEP
  
  3072:oDZaZeFbifra36ZbYNgLV3XJBbKuMHiJgpaJIK0rvox2qUQ:wgeYa3UbYuFPbUJaYrE
Score

10^/10

cobaltstrike pony backdoor rat spyware stealer trojan
- Cobaltstrike
  Detected malicious payload which is part of Cobaltstrike.
  trojan backdoor cobaltstrike
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

cobaltstrikeponybackdoorratspywarestealertrojan

behavioral2

cobaltstrikeponybackdoorratspywarestealertrojan