Overview

overview

10

Static

static

3326299b8e...cd.exe

windows7-x64

10

3326299b8e...cd.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3326299b8e9836e24c5373791de6a0176278d52995389da1f21018e56260f2cd

  • Size

    121KB

  • Sample

    221203-k3lh5ada6x

  • MD5

    4a5c2103dfc017b2f7586f0f63b7f8da

  • SHA1

    11fdaf369880f998536decc9d08722a77e305088

  • SHA256

    3326299b8e9836e24c5373791de6a0176278d52995389da1f21018e56260f2cd

  • SHA512

    f8c57da6650ef66b9047575cf40135609f42cde5f4b73133765cd0a9786ea35805663f38e1f23eed1d6740bd69d8c425a27094a8a708bb1619736d87d2b2a2a0

  • SSDEEP

    3072:mQQEJ2/xAmdr6mzpeS71HnpPfuo07Ms/m/F:n2/xp6pS71HndGo0bm/

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://prospexleads.com:8080/forum/viewtopic.php

http://phonebillssuck.com:8080/forum/viewtopic.php

http://myimpactblog.com:8080/forum/viewtopic.php

http://yourprospexblog.com:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://listinopainting.com/c8BHUBf.exe

    http://delhi.shaadibazaar.com/EDFrR4s.exe

    http://lemuelacosta.com/MZQB.exe

    http://by-style.info.dd12710.kasserver.com/x8ki.exe

Targets

    • Target

      3326299b8e9836e24c5373791de6a0176278d52995389da1f21018e56260f2cd

    • Size

      121KB

    • MD5

      4a5c2103dfc017b2f7586f0f63b7f8da

    • SHA1

      11fdaf369880f998536decc9d08722a77e305088

    • SHA256

      3326299b8e9836e24c5373791de6a0176278d52995389da1f21018e56260f2cd

    • SHA512

      f8c57da6650ef66b9047575cf40135609f42cde5f4b73133765cd0a9786ea35805663f38e1f23eed1d6740bd69d8c425a27094a8a708bb1619736d87d2b2a2a0

    • SSDEEP

      3072:mQQEJ2/xAmdr6mzpeS71HnpPfuo07Ms/m/F:n2/xp6pS71HndGo0bm/

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks