Overview

overview

10

Static

static

856abcf4a0...3e.exe

windows7-x64

10

856abcf4a0...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    856abcf4a0f730972a56d3e8c00f2d7daf50f5911052ccec07aef7234cf81d3e

  • Size

    105KB

  • Sample

    221201-cbnv6sha9y

  • MD5

    0a4ab21e0555ecb9425eeddd60ba6020

  • SHA1

    8ef782c83bf7959ca6acda2ddf4bafafcc504eba

  • SHA256

    856abcf4a0f730972a56d3e8c00f2d7daf50f5911052ccec07aef7234cf81d3e

  • SHA512

    918bfbaec9db379b47c0066222dc3e9de540e859ba62ea9898400eed55af8379d7fc1539365cff36e67c9026ec19553ddb46e4921b05a6c06a8e3d2ce4175336

  • SSDEEP

    1536:lEU3JRcVABK++lvEDI0m8C/vNZ68HK+5oeYHGp3RduqZiOynR:e+JJI+gv8ro/F8+5oeYmp3RcYiOUR

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://fplwekaxy.pw:719/way/open.php

http://jwetaltux.pw:719/way/open.php

Targets

    • Target

      856abcf4a0f730972a56d3e8c00f2d7daf50f5911052ccec07aef7234cf81d3e

    • Size

      105KB

    • MD5

      0a4ab21e0555ecb9425eeddd60ba6020

    • SHA1

      8ef782c83bf7959ca6acda2ddf4bafafcc504eba

    • SHA256

      856abcf4a0f730972a56d3e8c00f2d7daf50f5911052ccec07aef7234cf81d3e

    • SHA512

      918bfbaec9db379b47c0066222dc3e9de540e859ba62ea9898400eed55af8379d7fc1539365cff36e67c9026ec19553ddb46e4921b05a6c06a8e3d2ce4175336

    • SSDEEP

      1536:lEU3JRcVABK++lvEDI0m8C/vNZ68HK+5oeYHGp3RduqZiOynR:e+JJI+gv8ro/F8+5oeYmp3RcYiOUR

    Score
    10/10
    ponycollectiondiscoveryratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks