pony | 2958c7d173be690118582f6f5f0e80c954ba61b1c72effd98d5cf525bec576f6 | Triage

Sharing

General

Target

f302f330e11eae9a66647e6f87add648_JaffaCakes118
Size

128KB
Sample

240924-g5jkrsxelf
MD5

f302f330e11eae9a66647e6f87add648
SHA1

abde24bf818994c5f51d63201b8e4f6d86fd82ba
SHA256

2958c7d173be690118582f6f5f0e80c954ba61b1c72effd98d5cf525bec576f6
SHA512

1a4b5ab17cc077bb5d5440c90425744603407bfaa3316a74d0737fe3dc9df2a12c63482ea8b19b336fb2da33a22c79a45e59a4c4a581978d23e6ab89933f050a
SSDEEP

3072:uGHi6mw3Dl3q65eRX6BBZnF4ZohM+sJNH2MkHfbZjH:+gDs65m6BBjFhMFH2MkN

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php

Attributes

payload_url
http://ctl-mexico.com/WtgME.exe

http://cvilleshootingstars.com/JzU.exe

http://ctamdq.org.ar/bigQm.exe

Targets

- Target
  
  f302f330e11eae9a66647e6f87add648_JaffaCakes118
- Size
  
  128KB
- MD5
  
  f302f330e11eae9a66647e6f87add648
- SHA1
  
  abde24bf818994c5f51d63201b8e4f6d86fd82ba
- SHA256
  
  2958c7d173be690118582f6f5f0e80c954ba61b1c72effd98d5cf525bec576f6
- SHA512
  
  1a4b5ab17cc077bb5d5440c90425744603407bfaa3316a74d0737fe3dc9df2a12c63482ea8b19b336fb2da33a22c79a45e59a4c4a581978d23e6ab89933f050a
- SSDEEP
  
  3072:uGHi6mw3Dl3q65eRX6BBZnF4ZohM+sJNH2MkHfbZjH:+gDs65m6BBjFhMFH2MkN
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer