pony | 659ea4753a64cce6ac15e78802a21c5ba75596ff5a9d112295ba3484b1033064 | Triage

Submit
Reports

Overview

overview

Static

static

3

f281e9e83f...18.exe

windows7-x64

f281e9e83f...18.exe

windows10-2004-x64

Sharing

General

Target

f281e9e83fa9b24d5b06af36e91987ba_JaffaCakes118
Size

35KB
Sample

240922-v887gssaml
MD5

f281e9e83fa9b24d5b06af36e91987ba
SHA1

0d781c0a324f20d7464eeb9ea4480df7fd7f8b0d
SHA256

659ea4753a64cce6ac15e78802a21c5ba75596ff5a9d112295ba3484b1033064
SHA512

1c51a1fcbbd07aada1b2e08f4637d97b2d6b1929e819fd3ad230d1d88119e7e377ec7dd6354abcc77835256fe90ff54126001e96736b5a874132c78566cb1c08
SSDEEP

768:ryoqsQaTs+iN+9mcQIWlPLoXPli+s33gEBJoDR5Pjo:eoqsQNBNYTWlcXP0N3taP

Score

10^/10

pony credential_access discovery rat spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f281e9e83fa9b24d5b06af36e91987ba_JaffaCakes118.exe

Resource

win7-20240903-en

pony credential_access discovery rat spyware stealer upx

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

f281e9e83fa9b24d5b06af36e91987ba_JaffaCakes118.exe

Resource

win10v2004-20240802-en

pony credential_access discovery rat spyware stealer upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  f281e9e83fa9b24d5b06af36e91987ba_JaffaCakes118
- Size
  
  35KB
- MD5
  
  f281e9e83fa9b24d5b06af36e91987ba
- SHA1
  
  0d781c0a324f20d7464eeb9ea4480df7fd7f8b0d
- SHA256
  
  659ea4753a64cce6ac15e78802a21c5ba75596ff5a9d112295ba3484b1033064
- SHA512
  
  1c51a1fcbbd07aada1b2e08f4637d97b2d6b1929e819fd3ad230d1d88119e7e377ec7dd6354abcc77835256fe90ff54126001e96736b5a874132c78566cb1c08
- SSDEEP
  
  768:ryoqsQaTs+iN+9mcQIWlPLoXPli+s33gEBJoDR5Pjo:eoqsQNBNYTWlcXP0N3taP
Score

10^/10

pony credential_access discovery rat spyware stealer upx
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycredential_accessdiscoveryratspywarestealerupx

behavioral2

ponycredential_accessdiscoveryratspywarestealerupx

© 2018-2025

Terms | Privacy