Overview

overview

10

Static

static

1642cf2822...a2.exe

windows7-x64

10

1642cf2822...a2.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1642cf2822cbb26ca9e0fb3910c313a10bf73c9afe178a386c8a50963f67dba2

  • Size

    123KB

  • Sample

    221203-a7m8eaag99

  • MD5

    33e125b53ddd64fc20701671acc833d0

  • SHA1

    061c9064b9186fd1774afc5fb906da338bdbb473

  • SHA256

    1642cf2822cbb26ca9e0fb3910c313a10bf73c9afe178a386c8a50963f67dba2

  • SHA512

    2190c914d3b907ff16fadb1cf553485a264a0636d8895340a42e8849a746eb19d8592af5676d6dd350a3453e181a4c24857de1b60202816e401e2d94cbbe1010

  • SSDEEP

    3072:kAOOskoOzNw5sfwFDtk1++pZq7Cipoqy4ZkGK:psTOzNwu4NtWq7Ciygqd

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://prospexleads.com:8080/forum/viewtopic.php

http://phonebillssuck.com:8080/forum/viewtopic.php

http://myimpactblog.com:8080/forum/viewtopic.php

http://yourprospexblog.com:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://www.mshc.in/hKW.exe

    http://pcorbits.com/5edh9Au.exe

    http://95.110.228.229/Y0tmeeSZ.exe

    http://church.main.jp/Yr3P4h0P.exe

Targets

    • Target

      1642cf2822cbb26ca9e0fb3910c313a10bf73c9afe178a386c8a50963f67dba2

    • Size

      123KB

    • MD5

      33e125b53ddd64fc20701671acc833d0

    • SHA1

      061c9064b9186fd1774afc5fb906da338bdbb473

    • SHA256

      1642cf2822cbb26ca9e0fb3910c313a10bf73c9afe178a386c8a50963f67dba2

    • SHA512

      2190c914d3b907ff16fadb1cf553485a264a0636d8895340a42e8849a746eb19d8592af5676d6dd350a3453e181a4c24857de1b60202816e401e2d94cbbe1010

    • SSDEEP

      3072:kAOOskoOzNw5sfwFDtk1++pZq7Cipoqy4ZkGK:psTOzNwu4NtWq7Ciygqd

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks