pony | dc030778938b8b6f98236a709d0d18734c325accf44b12a55ecc2d56b8bb9000 | Triage

Sharing

General

Target

dc030778938b8b6f98236a709d0d18734c325accf44b12a55ecc2d56b8bb9000
Size

68KB
Sample

230505-zr3qlagg7x
MD5

3c4de20e464146bec844471867bd1628
SHA1

32f5611459b9b63145895926b26f949d8ce7ac79
SHA256

dc030778938b8b6f98236a709d0d18734c325accf44b12a55ecc2d56b8bb9000
SHA512

57a58f412c041e75002de2fcd2937faf914c3066fd98f0de61de5e08a7c6000d34d239452197d2f56557e57c1c496591e4f2574eff241139536cbcd620abe6fd
SSDEEP

1536:Nl2LanYqTjKNvS0439aureEhOUqvvFkzLA/0Zd/:z40N0439aceiOUU/0Z

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Targets

- Target
  
  dc030778938b8b6f98236a709d0d18734c325accf44b12a55ecc2d56b8bb9000
- Size
  
  68KB
- MD5
  
  3c4de20e464146bec844471867bd1628
- SHA1
  
  32f5611459b9b63145895926b26f949d8ce7ac79
- SHA256
  
  dc030778938b8b6f98236a709d0d18734c325accf44b12a55ecc2d56b8bb9000
- SHA512
  
  57a58f412c041e75002de2fcd2937faf914c3066fd98f0de61de5e08a7c6000d34d239452197d2f56557e57c1c496591e4f2574eff241139536cbcd620abe6fd
- SSDEEP
  
  1536:Nl2LanYqTjKNvS0439aureEhOUqvvFkzLA/0Zd/:z40N0439aceiOUU/0Z
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer