pony | b6dfd33e66bc2c7756c990352634e52a3da9322558e3ae12a9902b6c36716edf

General

Target

d2365afd1f60c74034fe4a616f82362f_JaffaCakes118
Size

181KB
Sample

240907-sgkcyazbnk
MD5

d2365afd1f60c74034fe4a616f82362f
SHA1

bdfa38f7963670a59d83665c856fda45164bdd6b
SHA256

b6dfd33e66bc2c7756c990352634e52a3da9322558e3ae12a9902b6c36716edf
SHA512

5395c33e046bb51ae073ebb826572446d4e8ea52a10e53046b5695d86655d295055dfa6102c6f85f85282b08ecea2e360fb18c6d3f5a16941f22381db7fb44d5
SSDEEP

1536:ec8gNsWjcdA8uo6iBZ8H8AzhTdQLIgkcTpvRCNVGuyS6bbEZmcKF/7kEBDXtAcZu:ogyXfBZ8H8DD6VGgKFgMDXt/4PATrn6

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://santeol.su/p/gate.php

http://www.kingperu.com/images/file.ecr

http://www.kadirzerey.com/wp-content/themes/genegri/file.ecr

http://www.interiorgallery.in/PImages/file.ecr

http://www.freemao.com/pics/file.ecr

http://www.florerialasfrecias.com/images/file.ecr

http://www.filmatelier.at/images/file.ecr

http://www.australia-citizenshiptest.com/Images/file.ecr

http://wallpaper.at.ua/images/file.ecr

http://visionstudio.ucoz.com/maybe/find/file.ecr

http://virus-tahk.ucoz.ru/you777/file.ecr

http://www.xxx18.ucoz.com/css/file.ecr

http://liga.moy.su/doc/file.ecr

http://multimarge.ph/images/file.ecr

http://murbil.hostei.com/wp-content/themes/Mizzo/file.ecr

http://mybinar.my1.ru/images/file.ecr

http://olliedesign.net/images/file.ecr

http://prolome.no.sapo.pt/imagens_aux/file.ecr

http://samuelmatos.home.sapo.pt/sites_ficheiros/file.ecr

http://www.garamaj.se/styles/file.ecr

Targets

- Target
  
  d2365afd1f60c74034fe4a616f82362f_JaffaCakes118
- Size
  
  181KB
- MD5
  
  d2365afd1f60c74034fe4a616f82362f
- SHA1
  
  bdfa38f7963670a59d83665c856fda45164bdd6b
- SHA256
  
  b6dfd33e66bc2c7756c990352634e52a3da9322558e3ae12a9902b6c36716edf
- SHA512
  
  5395c33e046bb51ae073ebb826572446d4e8ea52a10e53046b5695d86655d295055dfa6102c6f85f85282b08ecea2e360fb18c6d3f5a16941f22381db7fb44d5
- SSDEEP
  
  1536:ec8gNsWjcdA8uo6iBZ8H8AzhTdQLIgkcTpvRCNVGuyS6bbEZmcKF/7kEBDXtAcZu:ogyXfBZ8H8DD6VGgKFgMDXt/4PATrn6
Score

10^/10

pony collection credential_access discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2