pony | 6c764bcae2bb18edb2fdc35f537ee59ac3f13fc84f49ac18bc0805e883f6d9c3

General

Target
6c764bcae2bb18edb2fdc35f537ee59ac3f13fc84f49ac18bc0805e883f6d9c3
Size 126KB
Sample230129-3t8leaaa23
SHA256 6c764bcae2bb18edb2fdc35f537ee59ac3f13fc84f49ac18bc0805e883f6d9c3
MD5 185caa8d018a508ea16df52ad31df350
SHA1 44129c53f21491a139b0b079e006fd1724221205
SHA512 59b6e67798a7aeb55b61f9ee2fc401a1ecd1a9e413407d9f6f8d33f07460b9f74b746f5f940d8fece9dba96430d8ac267d4ae5fd6f0246400b29afa9a824b834
SSDEEP 3072:wzSyAtfr5UYwA1R1+dTCociatvCehpewRa:Ry+fN3RwdPcrtqehja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://www.arki.com:8080/forum/viewtopic.php
http://arki.com:8080/forum/viewtopic.php
http://50.57.185.72:8080/forum/viewtopic.php
http://buyfranklinrealty.com/forum/viewtopic.php

Attributes

payload_url
http://www.energiereise-namaste.de/EggT.exe

http://neelba.com/hZF3.exe

http://208.112.50.5/c38QVmd.exe

http://s148231503.onlinehome.us/y3R.exe

Targets

- Target
  6c764bcae2bb18edb2fdc35f537ee59ac3f13fc84f49ac18bc0805e883f6d9c3
- Size 126KB
- SHA256 6c764bcae2bb18edb2fdc35f537ee59ac3f13fc84f49ac18bc0805e883f6d9c3
- MD5 185caa8d018a508ea16df52ad31df350
- SHA1 44129c53f21491a139b0b079e006fd1724221205
- SHA512 59b6e67798a7aeb55b61f9ee2fc401a1ecd1a9e413407d9f6f8d33f07460b9f74b746f5f940d8fece9dba96430d8ac267d4ae5fd6f0246400b29afa9a824b834
- SSDEEP 3072:wzSyAtfr5UYwA1R1+dTCociatvCehpewRa:Ry+fN3RwdPcrtqehja
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

pony collection discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Pony,Fareit

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2