Overview

overview

10

Static

static

d45f65c6e3...d6.exe

windows7-x64

10

d45f65c6e3...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d45f65c6e3330ac53c483a7557e1e20fd3c07ae06ade2ce6426d47826e9409d6

  • Size

    44KB

  • Sample

    221203-ax436sda9s

  • MD5

    0769c81e2283601ebce36748c30465a6

  • SHA1

    20d82065d8939d2d0387725e9eaa116df0a0332e

  • SHA256

    d45f65c6e3330ac53c483a7557e1e20fd3c07ae06ade2ce6426d47826e9409d6

  • SHA512

    edc0f47530775d047666c5986357c306013beffbc0c31769a338b820928c66fa4f30773a47c61a7948275098b57459b5e7c1d60843a911dcb09a1893801af3d2

  • SSDEEP

    768:2iDtiVdDCDlfqr7bIO5HvVlAPl/PxPZDPCmKacT4ornKdyuuJ:nRiV0Dle7kgHvV+NBdPCmcpnKAJ

Score
10/10
ponycollectiondiscoveryratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://149.255.99.32:8080/forum/viewtopic.php

http://69.163.40.128/forum/viewtopic.php
Attributes
  • payload_url

    http://atualizacoes.issqn.net/FhPD.exe

    http://rampazzo.com.br/mbhyAkQ.exe

    http://homeringer.com/tWEkgm.exe

Targets

    • Target

      d45f65c6e3330ac53c483a7557e1e20fd3c07ae06ade2ce6426d47826e9409d6

    • Size

      44KB

    • MD5

      0769c81e2283601ebce36748c30465a6

    • SHA1

      20d82065d8939d2d0387725e9eaa116df0a0332e

    • SHA256

      d45f65c6e3330ac53c483a7557e1e20fd3c07ae06ade2ce6426d47826e9409d6

    • SHA512

      edc0f47530775d047666c5986357c306013beffbc0c31769a338b820928c66fa4f30773a47c61a7948275098b57459b5e7c1d60843a911dcb09a1893801af3d2

    • SSDEEP

      768:2iDtiVdDCDlfqr7bIO5HvVlAPl/PxPZDPCmKacT4ornKdyuuJ:nRiV0Dle7kgHvV+NBdPCmcpnKAJ

    Score
    10/10
    ponycollectiondiscoveryratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks