pony | 67f709a22b56ffda63b17e6fcb2a16b2d996366b798ee5a18c4a2d2cac6783ac | Triage

Sharing

General

Target

f568f53aeae5c8e5ddf22b239016ef79_JaffaCakes118
Size

92KB
Sample

240925-hbr6gszgnk
MD5

f568f53aeae5c8e5ddf22b239016ef79
SHA1

0deea32b500c7da8dacbcb329acff29e8732a03d
SHA256

67f709a22b56ffda63b17e6fcb2a16b2d996366b798ee5a18c4a2d2cac6783ac
SHA512

417562de82a2988b25aa272283a127d450bd01d56df6993239e33978a9cd73cbbabedf34c3feb98b12506dfcb6b9698562b74912e9c1f0ab1ad17d2075dc8296
SSDEEP

1536:Z/MgFGQCHxgUaFarKN0bYad+exuSOfCNGT7DIaUpm7Eimpo/GvfG:vApg9j0bYaVnNGT7DI3pm74pWyG

Score

10^/10

pony credential_access discovery rat spyware stealer

Malware Config

Targets

- Target
  
  f568f53aeae5c8e5ddf22b239016ef79_JaffaCakes118
- Size
  
  92KB
- MD5
  
  f568f53aeae5c8e5ddf22b239016ef79
- SHA1
  
  0deea32b500c7da8dacbcb329acff29e8732a03d
- SHA256
  
  67f709a22b56ffda63b17e6fcb2a16b2d996366b798ee5a18c4a2d2cac6783ac
- SHA512
  
  417562de82a2988b25aa272283a127d450bd01d56df6993239e33978a9cd73cbbabedf34c3feb98b12506dfcb6b9698562b74912e9c1f0ab1ad17d2075dc8296
- SSDEEP
  
  1536:Z/MgFGQCHxgUaFarKN0bYad+exuSOfCNGT7DIaUpm7Eimpo/GvfG:vApg9j0bYaVnNGT7DI3pm74pWyG
Score

10^/10

pony credential_access discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycredential_accessdiscoveryratspywarestealer

behavioral2