pony | b17ed5a652399226ed05901fbff8b738f91d269e5985e2dd503b419badaa5b12 | Triage

Sharing

General

Target

c49d610b33c5ed366cd3a80f2b396d30N.exe
Size

128KB
Sample

240830-rjx65szark
MD5

c49d610b33c5ed366cd3a80f2b396d30
SHA1

9636a3af9eff172497cc0534c8cee8730cb441f5
SHA256

b17ed5a652399226ed05901fbff8b738f91d269e5985e2dd503b419badaa5b12
SHA512

477828667c105055cb15d9b157480350e8515cf007dfeb1a3a99864a61f9fb79d2cbd546a9848fdbc666599a2f869232fa29826355f881ecf865958686212c54
SSDEEP

3072:uGHi6mw6fjNHsXJNYxHWPKBV4ENNCDjraVDAEmJI:+5fjOXJSxH54ENMjr+DAE

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php

Attributes

payload_url
http://ftp.approachit.com/jZy.exe

http://atualizacoes.issqn.net/FhPD.exe

http://tokulances.sitebr.net/jV1.exe

Targets

- Target
  
  c49d610b33c5ed366cd3a80f2b396d30N.exe
- Size
  
  128KB
- MD5
  
  c49d610b33c5ed366cd3a80f2b396d30
- SHA1
  
  9636a3af9eff172497cc0534c8cee8730cb441f5
- SHA256
  
  b17ed5a652399226ed05901fbff8b738f91d269e5985e2dd503b419badaa5b12
- SHA512
  
  477828667c105055cb15d9b157480350e8515cf007dfeb1a3a99864a61f9fb79d2cbd546a9848fdbc666599a2f869232fa29826355f881ecf865958686212c54
- SSDEEP
  
  3072:uGHi6mw6fjNHsXJNYxHWPKBV4ENNCDjraVDAEmJI:+5fjOXJSxH54ENMjr+DAE
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer