Overview

overview

10

Static

static

519bd990bb...83.exe

windows7-x64

10

519bd990bb...83.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    519bd990bbdbf85476c418c64e1a6aa625f0cf8bd3940e049f9940289204a383

  • Size

    113KB

  • Sample

    221201-3vrdhsgd6z

  • MD5

    e304bf9285a8a3573d7872875bb0a9b8

  • SHA1

    11f46a4744d392357f23ada97f6faa7ddc322234

  • SHA256

    519bd990bbdbf85476c418c64e1a6aa625f0cf8bd3940e049f9940289204a383

  • SHA512

    4e3c48fb803a71758b7c79b8df1fe652b665aba9adf2d6ffe823ff3bb37076d18016798e981fbe6d22cf737c34c2c3a4cd68ffe0cd5e957bdd3ad1f5903684f2

  • SSDEEP

    3072:lQWUivtKPYQtBLyVNpvuA13Zn1GQEtMdwYqmmdK:jUi1KPfbL6z9Z1zdwYw

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://abescasualgrill.net/forum/viewtopic.php

http://abescasualgrill.org/forum/viewtopic.php

http://abesexpress.com/forum/viewtopic.php

http://abesgastropub.co/forum/viewtopic.php
Attributes
  • payload_url

    http://mobilidea.com.mx/1wkYeV.exe

    http://academicjourneyonline.com/ExA.exe

    http://eurosfieldltd.co.uk/RLUa.exe

    http://0000bkb.rcomhost.com/Br8pxftu.exe

Targets

    • Target

      519bd990bbdbf85476c418c64e1a6aa625f0cf8bd3940e049f9940289204a383

    • Size

      113KB

    • MD5

      e304bf9285a8a3573d7872875bb0a9b8

    • SHA1

      11f46a4744d392357f23ada97f6faa7ddc322234

    • SHA256

      519bd990bbdbf85476c418c64e1a6aa625f0cf8bd3940e049f9940289204a383

    • SHA512

      4e3c48fb803a71758b7c79b8df1fe652b665aba9adf2d6ffe823ff3bb37076d18016798e981fbe6d22cf737c34c2c3a4cd68ffe0cd5e957bdd3ad1f5903684f2

    • SSDEEP

      3072:lQWUivtKPYQtBLyVNpvuA13Zn1GQEtMdwYqmmdK:jUi1KPfbL6z9Z1zdwYw

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks