pony | 57cbfd6f70865dc3c0d97dbd7f6177362dc9c9318043663456f963fd09373585 | Triage

Sharing

General

Target

57cbfd6f70865dc3c0d97dbd7f6177362dc9c9318043663456f963fd09373585.exe
Size

2.2MB
Sample

241205-p3gbmavpby
MD5

320ede7f7946b8c2874254a9a99199d7
SHA1

a27253bc87ad4c69af2874b04fd8891a5e0ee8f3
SHA256

57cbfd6f70865dc3c0d97dbd7f6177362dc9c9318043663456f963fd09373585
SHA512

d12fe2082635194ff1acb0b2b268a564efe806cfd6e55fbe0db870853e164b88de0babd488321e8a3682f1fad9d69e87076ec8ca324058fefdc328c63d818bfd
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwT

Score

10^/10

pony discovery

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  57cbfd6f70865dc3c0d97dbd7f6177362dc9c9318043663456f963fd09373585.exe
- Size
  
  2.2MB
- MD5
  
  320ede7f7946b8c2874254a9a99199d7
- SHA1
  
  a27253bc87ad4c69af2874b04fd8891a5e0ee8f3
- SHA256
  
  57cbfd6f70865dc3c0d97dbd7f6177362dc9c9318043663456f963fd09373585
- SHA512
  
  d12fe2082635194ff1acb0b2b268a564efe806cfd6e55fbe0db870853e164b88de0babd488321e8a3682f1fad9d69e87076ec8ca324058fefdc328c63d818bfd
- SSDEEP
  
  24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwT
Score

7^/10

discovery
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2