Overview

overview

10

Static

static

26f09f2d10...63.exe

windows7-x64

10

26f09f2d10...63.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    26f09f2d1082a4737cc44e06cbe43f17f19f29eab9f3cae7926c6c519a8a7b63

  • Size

    112KB

  • Sample

    221201-gvwgksef91

  • MD5

    0da0d612d2fac78a21c971a166545ed0

  • SHA1

    a317268910bd192a6ef1802a85c2958a24512dea

  • SHA256

    26f09f2d1082a4737cc44e06cbe43f17f19f29eab9f3cae7926c6c519a8a7b63

  • SHA512

    8f611b8027194ab21a9bc7654082247bde8a56e49e019de3619d3cd1d8239eb6a8e23dcd974bb0e89c763b6d864dfec06cd1d97ca868180af666c4c04f2dafe2

  • SSDEEP

    3072:pKve+Z2P1MMPHDdtB5u7XOPY8JHVQ8jW23Yawby:ceLM4HBz5OX6X9W2u

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://hitechcreature.com/forum/viewtopic.php

http://industryseeds.ca/forum/viewtopic.php

http://infocreature.com/forum/viewtopic.php

http://itanimal.com/forum/viewtopic.php
Attributes
  • payload_url

    http://prinburybiopharm.com/Gxm0Kq.exe

    http://www.forexmarketobserver.com/89DJ.exe

    http://encontact.com.mx/dZLe2.exe

    http://www.stirlinginvestmentgroup.com/xUG3.exe

Targets

    • Target

      26f09f2d1082a4737cc44e06cbe43f17f19f29eab9f3cae7926c6c519a8a7b63

    • Size

      112KB

    • MD5

      0da0d612d2fac78a21c971a166545ed0

    • SHA1

      a317268910bd192a6ef1802a85c2958a24512dea

    • SHA256

      26f09f2d1082a4737cc44e06cbe43f17f19f29eab9f3cae7926c6c519a8a7b63

    • SHA512

      8f611b8027194ab21a9bc7654082247bde8a56e49e019de3619d3cd1d8239eb6a8e23dcd974bb0e89c763b6d864dfec06cd1d97ca868180af666c4c04f2dafe2

    • SSDEEP

      3072:pKve+Z2P1MMPHDdtB5u7XOPY8JHVQ8jW23Yawby:ceLM4HBz5OX6X9W2u

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks