Overview

overview

10

Static

static

77b666a674...1b.exe

windows7-x64

10

77b666a674...1b.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    77b666a67400ff8e01f5f516d08e3f0e7640c01b7a57e153a01417f196bb861b

  • Size

    112KB

  • Sample

    221129-jcj2yahb28

  • MD5

    97381c4553974712d1c14063d74eecc4

  • SHA1

    e9a17bb8351e6ad2f1450104a3a27e53070066fd

  • SHA256

    77b666a67400ff8e01f5f516d08e3f0e7640c01b7a57e153a01417f196bb861b

  • SHA512

    c33472f4af157e6819b77b69ae58ab481336232f71c45eea08db473155bf17e3a50cbb8adc1aec6b9ace29f21bf1bb762c99e294df42cc810785c2162947fd7c

  • SSDEEP

    3072:byP1y4KIZYXRoJCJl97SF9AHRRyKLhn9xz:mtJ1Zeoml2W+Kt

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://br1.irontrial.com:8080/forum/viewtopic.php

http://br1.pineapplesdonthavesleeves.com:8080/forum/viewtopic.php

http://89.166.50.40:8080/forum/viewtopic.php

http://6.magicalomaha.com/forum/viewtopic.php
Attributes
  • payload_url

    http://www.weissewiese.de/jzVZ.exe

    http://sedefmakina.com/PRgHew5.exe

    http://cana-com.com/RM5hkX.exe

Targets

    • Target

      77b666a67400ff8e01f5f516d08e3f0e7640c01b7a57e153a01417f196bb861b

    • Size

      112KB

    • MD5

      97381c4553974712d1c14063d74eecc4

    • SHA1

      e9a17bb8351e6ad2f1450104a3a27e53070066fd

    • SHA256

      77b666a67400ff8e01f5f516d08e3f0e7640c01b7a57e153a01417f196bb861b

    • SHA512

      c33472f4af157e6819b77b69ae58ab481336232f71c45eea08db473155bf17e3a50cbb8adc1aec6b9ace29f21bf1bb762c99e294df42cc810785c2162947fd7c

    • SSDEEP

      3072:byP1y4KIZYXRoJCJl97SF9AHRRyKLhn9xz:mtJ1Zeoml2W+Kt

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks