pony | c7a1f8d16642703830d366aa9e0d91a434ebd9931465520bb5ad6124d477dd36

General

Target

6d1545db8933e5696adf614da37850d0_JaffaCakes118
Size

100KB
Sample

241023-etzfqsscpk
MD5

6d1545db8933e5696adf614da37850d0
SHA1

f345223abac74edd6d84b3718ff0e930a62219a8
SHA256

c7a1f8d16642703830d366aa9e0d91a434ebd9931465520bb5ad6124d477dd36
SHA512

98befb86cc11680a801cd908761e1fd7c1d082c960bf9d97d1a261b6cb13d17c8cc07ef815a823e0e4943ff523df3ae496dc274aab47f6714ee0c848ad486b8a
SSDEEP

1536:UF4Ap0b8MAqh5+6kfR3BlRSB/OI76cY6nh4FQ2IKPrdfGPZLv:UF4rJo58B/OI76z6htxOtGPZLv

Score

10^/10

Malware Config

Extracted

Family

pony

C2

http://4.islamicmid.com/forum/viewtopic.php

http://4.androidislamic.com/forum/viewtopic.php

Attributes

payload_url
http://badpal.it/ite.exe

http://mjorart.com/jTc.exe

http://bestinsighttours.com/bZ6.exe

http://rdquark.com/cAB.exe

http://quranaqiq.com/1kH.exe

http://www.westquimica.com/AuNP5.exe

http://www.superelectronico.com/cPY.exe

http://www.jagatoko.com/W14C.exe

http://muzikmeno.com/Y5m0Sx.exe

Targets

- Target
  
  6d1545db8933e5696adf614da37850d0_JaffaCakes118
- Size
  
  100KB
- MD5
  
  6d1545db8933e5696adf614da37850d0
- SHA1
  
  f345223abac74edd6d84b3718ff0e930a62219a8
- SHA256
  
  c7a1f8d16642703830d366aa9e0d91a434ebd9931465520bb5ad6124d477dd36
- SHA512
  
  98befb86cc11680a801cd908761e1fd7c1d082c960bf9d97d1a261b6cb13d17c8cc07ef815a823e0e4943ff523df3ae496dc274aab47f6714ee0c848ad486b8a
- SSDEEP
  
  1536:UF4Ap0b8MAqh5+6kfR3BlRSB/OI76cY6nh4FQ2IKPrdfGPZLv:UF4rJo58B/OI76z6htxOtGPZLv
Score

10^/10

pony collection credential_access discovery rat spyware stealer
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2