Overview

overview

10

Static

static

3

28ae40f544...eN.exe

windows7-x64

10

28ae40f544...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28ae40f54449d1f4f78c4c16c076386c7f802d8d317280a0d8d91c1a8d27f49eN.exe

  • Size

    164KB

  • Sample

    241128-22q6nazlcl

  • MD5

    9fc31c1cb7abe5ffccf76ff29c9067b0

  • SHA1

    695db55cdcc03d9c886f22f8c166ad1fdb5f4075

  • SHA256

    28ae40f54449d1f4f78c4c16c076386c7f802d8d317280a0d8d91c1a8d27f49e

  • SHA512

    3070645a8fc50449e582ae4c27e694e6ffaef593605d743328030f69ebaec6ca936c3aeae06671a99830603a98c48c2715b8c000a66e6aeac67b592bec89c90a

  • SSDEEP

    1536:EAlFLIOiugzakUEPIcMdqv/mN7YJ+lDxxLwUWK2U8AsihKlRC9NyUU:7l5iuguSP1ccWMUHZ8liwliN

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://teentraveltalk.com/ceqhsem.php

http://www.varwijk.nl/aqsuitp.php

http://rematec.ru/dacijwg.php

http://www.stiftung-marthahaus.de/uecdecb.php

http://sgmarket.ru/mlnlqap.php

http://dhm.home.pl/oxpjedg.php

http://artmatters.de/bwvupdf.php
Attributes
  • payload_url

    http://fotobit.pl/tmp/sm.exe

    http://fotobit.pl/tmp/np.exe

    http://fotobit.pl/tmp/smr.exe

Targets

    • Target

      28ae40f54449d1f4f78c4c16c076386c7f802d8d317280a0d8d91c1a8d27f49eN.exe

    • Size

      164KB

    • MD5

      9fc31c1cb7abe5ffccf76ff29c9067b0

    • SHA1

      695db55cdcc03d9c886f22f8c166ad1fdb5f4075

    • SHA256

      28ae40f54449d1f4f78c4c16c076386c7f802d8d317280a0d8d91c1a8d27f49e

    • SHA512

      3070645a8fc50449e582ae4c27e694e6ffaef593605d743328030f69ebaec6ca936c3aeae06671a99830603a98c48c2715b8c000a66e6aeac67b592bec89c90a

    • SSDEEP

      1536:EAlFLIOiugzakUEPIcMdqv/mN7YJ+lDxxLwUWK2U8AsihKlRC9NyUU:7l5iuguSP1ccWMUHZ8liwliN

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks