pony | c6428bcc0ad46ba7770898535810da3d712bae909d04ee618025c6840b3d57b5

General

Target

c6428bcc0ad46ba7770898535810da3d712bae909d04ee618025c6840b3d57b5
Size

99KB
Sample

221203-f2stlagg96
MD5

da387f5c77fe65852de958b72b2dd494
SHA1

32a2d28134a9bee76d82ebcab17fe4b8e9ea51d6
SHA256

c6428bcc0ad46ba7770898535810da3d712bae909d04ee618025c6840b3d57b5
SHA512

4b54ae387040d92b2e880c4ac465994302db7d2bb1c263d9e811a9f235dfe1e5d9f7fb75a1117a4016b1dd7759724425e8841862d7d1933ec5f61a4ed94e71aa
SSDEEP

3072:HgDNluE4cQpZioEQMISfaU+oOKvK+y2K1v6KLKe51BeXIq:CNwE4cQpYoEQMItUnOKvK+y2K1v6KLKa

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://coppercreek.ru/boi854tr4w.php

Attributes

payload_url
http://downloadinfo.ru/1.exe

Targets

- Target
  
  c6428bcc0ad46ba7770898535810da3d712bae909d04ee618025c6840b3d57b5
- Size
  
  99KB
- MD5
  
  da387f5c77fe65852de958b72b2dd494
- SHA1
  
  32a2d28134a9bee76d82ebcab17fe4b8e9ea51d6
- SHA256
  
  c6428bcc0ad46ba7770898535810da3d712bae909d04ee618025c6840b3d57b5
- SHA512
  
  4b54ae387040d92b2e880c4ac465994302db7d2bb1c263d9e811a9f235dfe1e5d9f7fb75a1117a4016b1dd7759724425e8841862d7d1933ec5f61a4ed94e71aa
- SSDEEP
  
  3072:HgDNluE4cQpZioEQMISfaU+oOKvK+y2K1v6KLKe51BeXIq:CNwE4cQpYoEQMItUnOKvK+y2K1v6KLKa
Score

10^/10

pony collection discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

2

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

UPX packed file

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2