pony | 932ba50df406f78588569a57348db5b5e1013aa28a9a7178553f343427fc8a07 | Triage

Sharing

General

Target

587cc925510582ed5ee90f6984d3d10dJaffaCakes118_NeikiAnalytics
Size

2.2MB
Sample

240529-2gtfaadc33
MD5

587cc925510582ed5ee90f6984d3d10d
SHA1

3a5d10cf3b5eb846fe195f9a6bee4f79f4a99479
SHA256

932ba50df406f78588569a57348db5b5e1013aa28a9a7178553f343427fc8a07
SHA512

7beb66f8efbd46c90a15cf76ae1c1118ffb0c52df8d7218d788ea67f907490483d919dc73a8b74a9eb18848543f9bdd16e1baae41bc232b078f1b9af6a89027c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwK

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  587cc925510582ed5ee90f6984d3d10dJaffaCakes118_NeikiAnalytics
- Size
  
  2.2MB
- MD5
  
  587cc925510582ed5ee90f6984d3d10d
- SHA1
  
  3a5d10cf3b5eb846fe195f9a6bee4f79f4a99479
- SHA256
  
  932ba50df406f78588569a57348db5b5e1013aa28a9a7178553f343427fc8a07
- SHA512
  
  7beb66f8efbd46c90a15cf76ae1c1118ffb0c52df8d7218d788ea67f907490483d919dc73a8b74a9eb18848543f9bdd16e1baae41bc232b078f1b9af6a89027c
- SSDEEP
  
  24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwK
Score

10^/10

pony evasion persistence rat spyware stealer
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Modifies Installed Components in the registry
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponyevasionpersistenceratspywarestealer

behavioral2

ponyevasionpersistenceratspywarestealer