pony | 1e691c7d27208c64bff15aca6f7b65fc3252a1dd8d87e08def8c3363c97f27dd | Triage

Sharing

General

Target

1e691c7d27208c64bff15aca6f7b65fc3252a1dd8d87e08def8c3363c97f27dd.exe
Size

2.6MB
Sample

241205-lct81stqfl
MD5

2d926d85d20f2aa688fb7fa54ee07c4e
SHA1

b02e05455154ca76e7dfa04b84bd004d715e9103
SHA256

1e691c7d27208c64bff15aca6f7b65fc3252a1dd8d87e08def8c3363c97f27dd
SHA512

e2708a5ec7f6c266099aad7aade09a5566befaa3ca18a1cd4a44fddfd6e2293638c46b5f8df7b957a0428169b05dbf6567b3c56ca0d07c38b849ca1edc350314
SSDEEP

49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlM:86SIROiFJiwp0xlrlM

Score

10^/10

pony discovery

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  1e691c7d27208c64bff15aca6f7b65fc3252a1dd8d87e08def8c3363c97f27dd.exe
- Size
  
  2.6MB
- MD5
  
  2d926d85d20f2aa688fb7fa54ee07c4e
- SHA1
  
  b02e05455154ca76e7dfa04b84bd004d715e9103
- SHA256
  
  1e691c7d27208c64bff15aca6f7b65fc3252a1dd8d87e08def8c3363c97f27dd
- SHA512
  
  e2708a5ec7f6c266099aad7aade09a5566befaa3ca18a1cd4a44fddfd6e2293638c46b5f8df7b957a0428169b05dbf6567b3c56ca0d07c38b849ca1edc350314
- SSDEEP
  
  49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlM:86SIROiFJiwp0xlrlM
Score

7^/10

discovery
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2