pony | 2371d8edbb2a1245b01cc06a870ddca49acb3be47b25e0fddc5d1b0032780bdf | Triage

Sharing

General

Target

18579d8151a242cf2e9b69b016479481_JaffaCakes118
Size

132KB
Sample

241006-q4jntaxbmk
MD5

18579d8151a242cf2e9b69b016479481
SHA1

051bd937961bad91c2a3074eb39c001e591758d6
SHA256

2371d8edbb2a1245b01cc06a870ddca49acb3be47b25e0fddc5d1b0032780bdf
SHA512

ec21b41a643ea5726a8b790bd16a048c79560eefe993578877d093784c2b75fa5d1176e7eddf25451ad935b720da79e0ae4697da4047d652f1e18a85cf7b7c3d
SSDEEP

3072:DfbmUkNmOJswwbO6Bmz9QKtOMGDjg3KxnP:jb/k7CZB29IMiU3W

Score

10^/10

pony discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://209.59.219.70/forum/viewtopic.php

Attributes

payload_url
http://ftp.approachit.com/jZy.exe

http://atualizacoes.issqn.net/FhPD.exe

http://tokulances.sitebr.net/jV1.exe

Targets

- Target
  
  18579d8151a242cf2e9b69b016479481_JaffaCakes118
- Size
  
  132KB
- MD5
  
  18579d8151a242cf2e9b69b016479481
- SHA1
  
  051bd937961bad91c2a3074eb39c001e591758d6
- SHA256
  
  2371d8edbb2a1245b01cc06a870ddca49acb3be47b25e0fddc5d1b0032780bdf
- SHA512
  
  ec21b41a643ea5726a8b790bd16a048c79560eefe993578877d093784c2b75fa5d1176e7eddf25451ad935b720da79e0ae4697da4047d652f1e18a85cf7b7c3d
- SSDEEP
  
  3072:DfbmUkNmOJswwbO6Bmz9QKtOMGDjg3KxnP:jb/k7CZB29IMiU3W
Score

10^/10

pony discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponydiscoveryratspywarestealer

behavioral2

ponydiscoveryratspywarestealer