pony | d2a67078408a4445650ddf0c70387e2e710b5eff4887d52f8a527924e6326ebf | Triage

Submit
Reports

Overview

overview

Static

static

3

e326687d4f...18.dll

windows7-x64

e326687d4f...18.dll

windows10-2004-x64

Sharing

General

Target

e326687d4f1c249ced102a3c482d1c63_JaffaCakes118
Size

76KB
Sample

241211-zjad3sxqax
MD5

e326687d4f1c249ced102a3c482d1c63
SHA1

3db7f7811d8bf9b26b115425abaaf3abea8025dd
SHA256

d2a67078408a4445650ddf0c70387e2e710b5eff4887d52f8a527924e6326ebf
SHA512

7afd925458dcbbc8674d5882293c46964e3df2c9f5c7e20b10b983f034de1622b73072efc0f8e969fc3b78d1695bdc34173ac8b74f6862a1418939b8485f34a2
SSDEEP

1536:ucOhGnTBlIcWBy0PGfhs2j48dAIEGTpN+q2ZX5MhI:4olEc0efh5jHSI/pN+q2ZXKhI

Score

10^/10

pony credential_access discovery rat spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e326687d4f1c249ced102a3c482d1c63_JaffaCakes118.dll

Resource

win7-20241023-en

pony credential_access discovery rat spyware stealer upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

e326687d4f1c249ced102a3c482d1c63_JaffaCakes118.dll

Resource

win10v2004-20241007-en

pony credential_access discovery rat spyware stealer upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  e326687d4f1c249ced102a3c482d1c63_JaffaCakes118
- Size
  
  76KB
- MD5
  
  e326687d4f1c249ced102a3c482d1c63
- SHA1
  
  3db7f7811d8bf9b26b115425abaaf3abea8025dd
- SHA256
  
  d2a67078408a4445650ddf0c70387e2e710b5eff4887d52f8a527924e6326ebf
- SHA512
  
  7afd925458dcbbc8674d5882293c46964e3df2c9f5c7e20b10b983f034de1622b73072efc0f8e969fc3b78d1695bdc34173ac8b74f6862a1418939b8485f34a2
- SSDEEP
  
  1536:ucOhGnTBlIcWBy0PGfhs2j48dAIEGTpN+q2ZX5MhI:4olEc0efh5jHSI/pN+q2ZXKhI
Score

10^/10

pony credential_access discovery rat spyware stealer upx
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycredential_accessdiscoveryratspywarestealerupx

behavioral2

ponycredential_accessdiscoveryratspywarestealerupx

© 2018-2025

Terms | Privacy