pony | 73ca2fd78e80524971b45b9592103f2015873df21152316624836a8f588b25e5 | Triage

Submit
Reports

Overview

overview

Static

static

3

dd0197ac5a...18.dll

windows7-x64

dd0197ac5a...18.dll

windows10-2004-x64

Sharing

General

Target

dd0197ac5a91291488671b1a96f052f8_JaffaCakes118
Size

76KB
Sample

241210-e3t8daynbk
MD5

dd0197ac5a91291488671b1a96f052f8
SHA1

000ef481f449f66cd16e4f84ad9d1de938b067a7
SHA256

73ca2fd78e80524971b45b9592103f2015873df21152316624836a8f588b25e5
SHA512

5916b1c0b42f85594e4a81507271f2fb60cf61ca5133ec6d31e0ed1e09ee789d8e7f6108d5b30b5c3e2145407d72efbb14989deab49c471c522712fd3e72ee8f
SSDEEP

1536:d08ycVb3jZUVVS4DgzeZqJvhmjK5ZxMbngWYpaA9HAhWoICEWMPo:1ycV4ieZq1kjKrxMrctghrIlWMg

Score

10^/10

pony credential_access discovery rat spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

dd0197ac5a91291488671b1a96f052f8_JaffaCakes118.dll

Resource

win7-20240903-en

pony credential_access discovery rat spyware stealer upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

dd0197ac5a91291488671b1a96f052f8_JaffaCakes118.dll

Resource

win10v2004-20241007-en

pony credential_access discovery rat spyware stealer upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  dd0197ac5a91291488671b1a96f052f8_JaffaCakes118
- Size
  
  76KB
- MD5
  
  dd0197ac5a91291488671b1a96f052f8
- SHA1
  
  000ef481f449f66cd16e4f84ad9d1de938b067a7
- SHA256
  
  73ca2fd78e80524971b45b9592103f2015873df21152316624836a8f588b25e5
- SHA512
  
  5916b1c0b42f85594e4a81507271f2fb60cf61ca5133ec6d31e0ed1e09ee789d8e7f6108d5b30b5c3e2145407d72efbb14989deab49c471c522712fd3e72ee8f
- SSDEEP
  
  1536:d08ycVb3jZUVVS4DgzeZqJvhmjK5ZxMbngWYpaA9HAhWoICEWMPo:1ycV4ieZq1kjKrxMrctghrIlWMg
Score

10^/10

pony credential_access discovery rat spyware stealer upx
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycredential_accessdiscoveryratspywarestealerupx

behavioral2

ponycredential_accessdiscoveryratspywarestealerupx

© 2018-2025

Terms | Privacy