pony | d4038474f036f37854e45d395313b9f5a14655189ecdd57ef4156cbcc7af43dc | Triage

Sharing

General

Target

6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118
Size

2.2MB
Sample

240523-tz3snshb3x
MD5

6b8ecc6e0ebeeed7be7fb545be0a98e1
SHA1

2392de2f5206e6b88ed3eaa346e1dcd70c14a229
SHA256

d4038474f036f37854e45d395313b9f5a14655189ecdd57ef4156cbcc7af43dc
SHA512

25d9f8f8bb702537095f7634e1037304643a6b2af67a58c9185a59f669f512ce818dc4f4fc96e9db729df05b0f7967eec4874915090e91293b8d61e11cea1557
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwY

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  6b8ecc6e0ebeeed7be7fb545be0a98e1_JaffaCakes118
- Size
  
  2.2MB
- MD5
  
  6b8ecc6e0ebeeed7be7fb545be0a98e1
- SHA1
  
  2392de2f5206e6b88ed3eaa346e1dcd70c14a229
- SHA256
  
  d4038474f036f37854e45d395313b9f5a14655189ecdd57ef4156cbcc7af43dc
- SHA512
  
  25d9f8f8bb702537095f7634e1037304643a6b2af67a58c9185a59f669f512ce818dc4f4fc96e9db729df05b0f7967eec4874915090e91293b8d61e11cea1557
- SSDEEP
  
  24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwY
Score

10^/10

pony evasion persistence rat spyware stealer
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Modifies Installed Components in the registry
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponyevasionpersistenceratspywarestealer

behavioral2

ponyevasionpersistenceratspywarestealer