pony | f07e40ffbd04ad62b340df0525e8b241825ebdddb84d705e822f4e2a803d94c9

General

Target

1689f21a297c17679364e003f174666e_JaffaCakes118
Size

269KB
Sample

240627-sze6yazfpj
MD5

1689f21a297c17679364e003f174666e
SHA1

089ebf58921b20063d7bbe825cd9dca157bf4b4b
SHA256

f07e40ffbd04ad62b340df0525e8b241825ebdddb84d705e822f4e2a803d94c9
SHA512

19e3b9ae49772dd26121d5e1982d5843efe61e2df53c4f9c4d846f772d16d7387871d343eca8dbe82b894acd4133f871bd255c3cfa6a191ea0c55761bded1939
SSDEEP

6144:pWFLa71gBbPzJAIwSxoa0o/EKelV3XIlAlLLX51VciOooQvL:pOa7GBPTaue7IOlL750i7tv

Score

10^/10

Malware Config

Targets

- Target
  
  1689f21a297c17679364e003f174666e_JaffaCakes118
- Size
  
  269KB
- MD5
  
  1689f21a297c17679364e003f174666e
- SHA1
  
  089ebf58921b20063d7bbe825cd9dca157bf4b4b
- SHA256
  
  f07e40ffbd04ad62b340df0525e8b241825ebdddb84d705e822f4e2a803d94c9
- SHA512
  
  19e3b9ae49772dd26121d5e1982d5843efe61e2df53c4f9c4d846f772d16d7387871d343eca8dbe82b894acd4133f871bd255c3cfa6a191ea0c55761bded1939
- SSDEEP
  
  6144:pWFLa71gBbPzJAIwSxoa0o/EKelV3XIlAlLLX51VciOooQvL:pOa7GBPTaue7IOlL750i7tv
Score

10^/10

pony discovery evasion persistence rat spyware stealer upx
- Modifies security service
  evasion
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2