pony | 248ec8736589c4af84b43921037066244703beef5cf4fa954bf6c9168f64f6c3 | Triage

Sharing

General

Target

131b3a325d4ed725c1c189abe3dc7777_JaffaCakes118
Size

143KB
Sample

241004-nab1rsvdma
MD5

131b3a325d4ed725c1c189abe3dc7777
SHA1

4acf2f2832807f4d2649e49ab7f640492a0922ff
SHA256

248ec8736589c4af84b43921037066244703beef5cf4fa954bf6c9168f64f6c3
SHA512

4a3cd0d6e45e575eeff6a9ff30682a69a1c1c5e9eb2fd7d9eec6eb442e4c78d4e8a3ac84222c1884e79cc829131bfd6c41e80dc67bfa025c7b1a292cc4bf1eca
SSDEEP

3072:XjlKZelTD7JDwz0ZL+/bjgUzLwZ0bCf8lR3paJ1P6L0k:JwelxwzaLOo4Y0bfha/CL0

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://66.55.89.150:8080/forum/viewtopic.php

http://66.55.89.151:8080/forum/viewtopic.php

Attributes

payload_url
http://cef02guara.org.br/7fSos.exe

http://biskercentre.org/FEhyRBhG.exe

http://www.cursaodofabao.com.br/DCBXA.exe

Targets

- Target
  
  131b3a325d4ed725c1c189abe3dc7777_JaffaCakes118
- Size
  
  143KB
- MD5
  
  131b3a325d4ed725c1c189abe3dc7777
- SHA1
  
  4acf2f2832807f4d2649e49ab7f640492a0922ff
- SHA256
  
  248ec8736589c4af84b43921037066244703beef5cf4fa954bf6c9168f64f6c3
- SHA512
  
  4a3cd0d6e45e575eeff6a9ff30682a69a1c1c5e9eb2fd7d9eec6eb442e4c78d4e8a3ac84222c1884e79cc829131bfd6c41e80dc67bfa025c7b1a292cc4bf1eca
- SSDEEP
  
  3072:XjlKZelTD7JDwz0ZL+/bjgUzLwZ0bCf8lR3paJ1P6L0k:JwelxwzaLOo4Y0bfha/CL0
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer