Overview

overview

10

Static

static

3

733daf76da...da.exe

windows7-x64

10

733daf76da...da.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    733daf76da6afeb0667254280192066cedb7998d39622c3c631b6497b3bddfda.exe

  • Size

    119KB

  • Sample

    250107-1ect3s1qcq

  • MD5

    b89a47f25412452c5f1ba20833a5ab97

  • SHA1

    cb9c010f4732db01db3e5a808767b805f34592b9

  • SHA256

    733daf76da6afeb0667254280192066cedb7998d39622c3c631b6497b3bddfda

  • SHA512

    3b234d179abe4b1b8d23ceff7d037893122b0f0efb9b2a39498e1eccd3be93a923db2800b82e20f6f439c0c2b776925af247e944d41d1a79907305895d1e9d63

  • SSDEEP

    3072:qMgKFIsviXhl3oOqKG37lyRKfXBx0iQkYIKbCujQd:qMgKF9vixhgKO4Ru8iQj7q

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://forum.xcpus.com:8080/ponyz/gate.php

http://onlinerummygamesguide.com/ponyz/gate.php

http://page10group.com/ponyz/gate.php

http://page10group.net/ponyz/gate.php
Attributes
  • payload_url

    http://1494ccc706155932.lolipop.jp/fA1nv43e.exe

    http://s252653471.onlinehome.us/fQSh.exe

    http://preventchildabuse.childrensociety.org.sg/yA9ipF.exe

Targets

    • Target

      733daf76da6afeb0667254280192066cedb7998d39622c3c631b6497b3bddfda.exe

    • Size

      119KB

    • MD5

      b89a47f25412452c5f1ba20833a5ab97

    • SHA1

      cb9c010f4732db01db3e5a808767b805f34592b9

    • SHA256

      733daf76da6afeb0667254280192066cedb7998d39622c3c631b6497b3bddfda

    • SHA512

      3b234d179abe4b1b8d23ceff7d037893122b0f0efb9b2a39498e1eccd3be93a923db2800b82e20f6f439c0c2b776925af247e944d41d1a79907305895d1e9d63

    • SSDEEP

      3072:qMgKFIsviXhl3oOqKG37lyRKfXBx0iQkYIKbCujQd:qMgKF9vixhgKO4Ru8iQj7q

    Score
    10/10
    ponycollectioncredential_accessdiscoveryratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks