Overview

overview

10

Static

static

10

70b8ba21c9...cs.exe

windows7-x64

10

70b8ba21c9...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70b8ba21c9ccb6c38da9eb8f62a4d9c0_NeikiAnalytics.exe

  • Size

    81KB

  • Sample

    240526-f4f8kshc63

  • MD5

    70b8ba21c9ccb6c38da9eb8f62a4d9c0

  • SHA1

    f9137ee251ec9d2c812d397f1a48efccdfb7aa68

  • SHA256

    97799f634baf237696b725bb4caeb56a6dffbe0792c712dfb646f2f636303b49

  • SHA512

    36958230d213ce6b073a42e5d681f34830caa0a76700b6f2c778cc32f255b88fae1c75deb78531f9c54fd339481205357eca468a1611bc07786b7f527d74ac53

  • SSDEEP

    1536:wSnzGMOqTADN+JZF6epb1nPG3FN7BSmUTvUEYXkZvt2Nc:wmzZJbzpRPG3FNvEYAvtOc

Score
10/10
ponydiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://spna.ca:8080/pony/gate.php

http://dare2dreamz.com:8080/pony/gate.php
Attributes
  • payload_url

    http://proyectoindio.org/7Qo.exe

    http://astronomika.com/493.exe

    http://12am.ro/0iZDFn1.exe

Targets

    • Target

      70b8ba21c9ccb6c38da9eb8f62a4d9c0_NeikiAnalytics.exe

    • Size

      81KB

    • MD5

      70b8ba21c9ccb6c38da9eb8f62a4d9c0

    • SHA1

      f9137ee251ec9d2c812d397f1a48efccdfb7aa68

    • SHA256

      97799f634baf237696b725bb4caeb56a6dffbe0792c712dfb646f2f636303b49

    • SHA512

      36958230d213ce6b073a42e5d681f34830caa0a76700b6f2c778cc32f255b88fae1c75deb78531f9c54fd339481205357eca468a1611bc07786b7f527d74ac53

    • SSDEEP

      1536:wSnzGMOqTADN+JZF6epb1nPG3FN7BSmUTvUEYXkZvt2Nc:wmzZJbzpRPG3FNvEYAvtOc

    Score
    10/10
    ponydiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks