pony | c7211bedd094d9c5dd76e2f2ff9bc9fd4f3d2fd038dbd76e94c0a4c6d27640eb

General

Target

c7211bedd094d9c5dd76e2f2ff9bc9fd4f3d2fd038dbd76e94c0a4c6d27640eb
Size

97KB
Sample

221203-brgw5afe2v
MD5

e7efcf0faae02642ab1e8f17b5f8303f
SHA1

6064f247e17e7ba554e0f32e803ed8c0e5d724a5
SHA256

c7211bedd094d9c5dd76e2f2ff9bc9fd4f3d2fd038dbd76e94c0a4c6d27640eb
SHA512

978ba664484bd31e7202624c8c51c6559651adb5a9ff838ce47c913e53fa69086602d174586cf70399ca69630431c12654449537cec816a98c5688592a2f3eaf
SSDEEP

1536:idOlNwS0IjRJOsjyIa5dd60z+P/onzC72Q+b7xkQQ:iMTwS0IjRUsj6Y0z+3omz+b7a

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://65.75.137.237/gate.php

http://65.75.138.212/gate.php

http://65.75.139.225/gate.php

http://65.75.140.218/gate.php

http://65.75.141.214/gate.php

http://65.75.142.202/gate.php

http://65.75.143.189/gate.php

http://65.75.144.219/gate.php

http://65.75.145.215/gate.php

http://65.75.146.203/gate.php

http://65.75.147.203/gate.php

http://65.75.148.198/gate.php

http://65.75.149.202/gate.php

http://simple-cdn-node.com/gate.php

Attributes

payload_url
http://metallungies.com/wp-includes/pomo/st.exe

Targets

- Target
  
  c7211bedd094d9c5dd76e2f2ff9bc9fd4f3d2fd038dbd76e94c0a4c6d27640eb
- Size
  
  97KB
- MD5
  
  e7efcf0faae02642ab1e8f17b5f8303f
- SHA1
  
  6064f247e17e7ba554e0f32e803ed8c0e5d724a5
- SHA256
  
  c7211bedd094d9c5dd76e2f2ff9bc9fd4f3d2fd038dbd76e94c0a4c6d27640eb
- SHA512
  
  978ba664484bd31e7202624c8c51c6559651adb5a9ff838ce47c913e53fa69086602d174586cf70399ca69630431c12654449537cec816a98c5688592a2f3eaf
- SSDEEP
  
  1536:idOlNwS0IjRJOsjyIa5dd60z+P/onzC72Q+b7xkQQ:iMTwS0IjRUsj6Y0z+3omz+b7a
Score

10^/10

pony collection discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2