pony | 6a13ea0e470634cc76134de213f2fa49ffa122b5c922ac2622cd7ef437eb7f0a

General

Target

6fdb5a7b57efcfc726ea6fff1fddc1dd_JaffaCakes118
Size

153KB
Sample

240725-q8fsqavfja
MD5

6fdb5a7b57efcfc726ea6fff1fddc1dd
SHA1

98beb17cbaf9da98f6cc336c4724b30a15640c75
SHA256

6a13ea0e470634cc76134de213f2fa49ffa122b5c922ac2622cd7ef437eb7f0a
SHA512

d2d7791424c9e530191875be31d15646691505f5b6c2afe72be07314f46052738dfafe1278e86c98fe337f36b464fedeb18b69391decb2582b5fdf41087d4758
SSDEEP

3072:jOcLmp8vTNFZtJcgg04cDENvDQoNjMdPB23S6:jO0TvTNFr7g04cDENfNGU3S

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php

Attributes

payload_url
http://www.drachenboot-strausberg.de/rgbykPm.exe

http://realitycoaching.es/23sf.exe

http://kms-anwaelte.de/mvCo.exe

Targets

- Target
  
  6fdb5a7b57efcfc726ea6fff1fddc1dd_JaffaCakes118
- Size
  
  153KB
- MD5
  
  6fdb5a7b57efcfc726ea6fff1fddc1dd
- SHA1
  
  98beb17cbaf9da98f6cc336c4724b30a15640c75
- SHA256
  
  6a13ea0e470634cc76134de213f2fa49ffa122b5c922ac2622cd7ef437eb7f0a
- SHA512
  
  d2d7791424c9e530191875be31d15646691505f5b6c2afe72be07314f46052738dfafe1278e86c98fe337f36b464fedeb18b69391decb2582b5fdf41087d4758
- SSDEEP
  
  3072:jOcLmp8vTNFZtJcgg04cDENvDQoNjMdPB23S6:jO0TvTNFr7g04cDENfNGU3S
Score

10^/10

pony collection credential_access discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2