pony | 90355ac01d78cb27c279086208ad012773a7a28de5ad57eda5c146b4412400ad | Triage

Sharing

General

Target

e700425982d70d2a1b7e24e885781230_JaffaCakes118
Size

145KB
Sample

240917-rkljqsxbld
MD5

e700425982d70d2a1b7e24e885781230
SHA1

0bc9fd762be52e557d64339194a442b9e3b5e84d
SHA256

90355ac01d78cb27c279086208ad012773a7a28de5ad57eda5c146b4412400ad
SHA512

74d62bf999271cee09792bdd69061ca2f300f13050a29f6f21652e65414eb93685d51b8c01aa7a9774fa4931a07882b277dbf788a5c290fb2bab7d73e05228ed
SSDEEP

3072:J9Pk3IqcKNXi/ASU2VI4O6FGCesqLTRoW3kU5NO4gfovR9:HoTKc2VItsETSWo9fovR

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://209.59.219.1/forum/viewtopic.php

http://212.58.20.11/forum/viewtopic.php

Attributes

payload_url
http://www.Scouts332.org/besZ.exe

http://mob.webmediafiji.com/1G0.exe

Targets

- Target
  
  e700425982d70d2a1b7e24e885781230_JaffaCakes118
- Size
  
  145KB
- MD5
  
  e700425982d70d2a1b7e24e885781230
- SHA1
  
  0bc9fd762be52e557d64339194a442b9e3b5e84d
- SHA256
  
  90355ac01d78cb27c279086208ad012773a7a28de5ad57eda5c146b4412400ad
- SHA512
  
  74d62bf999271cee09792bdd69061ca2f300f13050a29f6f21652e65414eb93685d51b8c01aa7a9774fa4931a07882b277dbf788a5c290fb2bab7d73e05228ed
- SSDEEP
  
  3072:J9Pk3IqcKNXi/ASU2VI4O6FGCesqLTRoW3kU5NO4gfovR9:HoTKc2VItsETSWo9fovR
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer