pony | 3891efa784812951fc4fb86638a9e2df46552baaaa78ef2a0537dad2e874e87d | Triage

Sharing

General

Target

be6f57496831dab8b620ffc30036740a_JaffaCakes118
Size

178KB
Sample

241203-vygdqavpgt
MD5

be6f57496831dab8b620ffc30036740a
SHA1

bfec7d5289d80adde3e46565d90b0d407ef6d3ad
SHA256

3891efa784812951fc4fb86638a9e2df46552baaaa78ef2a0537dad2e874e87d
SHA512

f29a54bce0556611f28316fda7b360be46034e2b1c2c7f28e71ce1a16d26e1202ac921dba98bb442739ab52734ce1d3e15804308cd1ebb0766066f83bd1cf247
SSDEEP

3072:QU1eji5yoSfDGPPfRWtbBoj40dZuUAE1br+X2:LAji5yoSfDGPQtbij1fH+m

Score

10^/10

pony credential_access discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://222.255.28.16:8080/pony/gate.php

http://88.119.29.2:8080/pony/gate.php

Attributes

payload_url
http://www.lnap.com/qTXnw.exe

http://handicappingsolutions.com/1tf.exe

http://saberedn.com.ar/eYe.exe

Targets

- Target
  
  be6f57496831dab8b620ffc30036740a_JaffaCakes118
- Size
  
  178KB
- MD5
  
  be6f57496831dab8b620ffc30036740a
- SHA1
  
  bfec7d5289d80adde3e46565d90b0d407ef6d3ad
- SHA256
  
  3891efa784812951fc4fb86638a9e2df46552baaaa78ef2a0537dad2e874e87d
- SHA512
  
  f29a54bce0556611f28316fda7b360be46034e2b1c2c7f28e71ce1a16d26e1202ac921dba98bb442739ab52734ce1d3e15804308cd1ebb0766066f83bd1cf247
- SSDEEP
  
  3072:QU1eji5yoSfDGPPfRWtbBoj40dZuUAE1br+X2:LAji5yoSfDGPQtbij1fH+m
Score

10^/10

pony credential_access discovery rat spyware stealer
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycredential_accessdiscoveryratspywarestealer

behavioral2

ponycredential_accessdiscoveryratspywarestealer