pony | 3f0b844ded61a2d75b20fd249b31e8e60f764d6a1be695fd37ae6f7d147b135c | Triage

Sharing

General

Target

JaffaCakes118_6886e758ce5d6de1923f7fdbf588f569
Size

115KB
Sample

250102-141bnsxngv
MD5

6886e758ce5d6de1923f7fdbf588f569
SHA1

561520cfe6c346595d4fd3012483138b2067c391
SHA256

3f0b844ded61a2d75b20fd249b31e8e60f764d6a1be695fd37ae6f7d147b135c
SHA512

cd48482e0d8e3421febae96c9626a7f65bf0d5729ca9ce2de07fde3b8e34b7c95e00829d0d8b163c443ba0f49a85cd9a176a6e1d1f60eb5e0786a52460be824e
SSDEEP

3072:ejUDPDdpdiVDoX8HBh9nMRntLZ8kChSJTORoF6:uV88h9nMRr8kChSJT8k

Score

10^/10

pony collection credential_access discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://clotheswalla.com/forum/viewtopic.php

http://consumerluggage.com/forum/viewtopic.php

http://coolstowage.com/forum/viewtopic.php

http://couponwalla.com/forum/viewtopic.php

Attributes

payload_url
http://www.moruscelsa.com/gU8nC6.exe

http://globaldoesitall.com/hPr0.exe

http://derricoassociati.it/rjrtYyw5.exe

http://9ain.net/easm1.exe

Targets

- Target
  
  JaffaCakes118_6886e758ce5d6de1923f7fdbf588f569
- Size
  
  115KB
- MD5
  
  6886e758ce5d6de1923f7fdbf588f569
- SHA1
  
  561520cfe6c346595d4fd3012483138b2067c391
- SHA256
  
  3f0b844ded61a2d75b20fd249b31e8e60f764d6a1be695fd37ae6f7d147b135c
- SHA512
  
  cd48482e0d8e3421febae96c9626a7f65bf0d5729ca9ce2de07fde3b8e34b7c95e00829d0d8b163c443ba0f49a85cd9a176a6e1d1f60eb5e0786a52460be824e
- SSDEEP
  
  3072:ejUDPDdpdiVDoX8HBh9nMRntLZ8kChSJTORoF6:uV88h9nMRr8kChSJT8k
Score

10^/10

pony collection credential_access discovery rat spyware stealer
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycollectioncredential_accessdiscoveryratspywarestealer

behavioral2