Overview

overview

10

Static

static

a6adc01144...cb.exe

windows7-x64

10

a6adc01144...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6adc011444ed48ab6262c5baa629ccb.exe

  • Size

    715KB

  • Sample

    230101-nfzn1seg21

  • MD5

    a6adc011444ed48ab6262c5baa629ccb

  • SHA1

    31dca548f6c624240cff5a87832cac8ddbee606b

  • SHA256

    a10a1ba5f4445a910d14fd72af43f010c503dd08e31ac2c1a84f15e568455115

  • SHA512

    7a9276737d272d99590a1b0704baea8248b6f9f1cd4da06ba51095b8792499f94258e8a305780da66d7c71bc6a97a6cf69b8d7af39ffe63448d52d4ba7eb61b7

  • SSDEEP

    12288:1dbp2VMvk8YYUzu+NFoN4mJxKoXmONXcEP30mMHlJfm:1dbFvfYYf+NFVmJELO3wrfm

Score
10/10
ponyagilenetcollectionratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://imadiary.com/blog/panel/gate.php

Targets

    • Target

      a6adc011444ed48ab6262c5baa629ccb.exe

    • Size

      715KB

    • MD5

      a6adc011444ed48ab6262c5baa629ccb

    • SHA1

      31dca548f6c624240cff5a87832cac8ddbee606b

    • SHA256

      a10a1ba5f4445a910d14fd72af43f010c503dd08e31ac2c1a84f15e568455115

    • SHA512

      7a9276737d272d99590a1b0704baea8248b6f9f1cd4da06ba51095b8792499f94258e8a305780da66d7c71bc6a97a6cf69b8d7af39ffe63448d52d4ba7eb61b7

    • SSDEEP

      12288:1dbp2VMvk8YYUzu+NFoN4mJxKoXmONXcEP30mMHlJfm:1dbFvfYYf+NFVmJELO3wrfm

    Score
    10/10
    ponyagilenetcollectionratspywarestealerupx

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Email Collection

2
T1114

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks