pony | 24e62f812d15415d1f950f704da6e15da678b3a2e1315be2aa0d262f1e5425c5

Resubmissions

15-01-2025 15:59

250115-te451aypap 10

15-01-2025 14:53

250115-r89w8swkdy 10

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_5a058837d9999de9f669dcda66ed1d31
Size

92KB
Sample

250115-te451aypap
MD5

5a058837d9999de9f669dcda66ed1d31
SHA1

df675fda6651012df81f9959d040ddfaff160dcb
SHA256

24e62f812d15415d1f950f704da6e15da678b3a2e1315be2aa0d262f1e5425c5
SHA512

c643c85b03884639fa06e00a77b247adaa4f29601ad3bd7152c25780d45ff03016352d24bc1fb5afda14466629fff57eeffaa8eb5f022941642ca5abfab7a44e
SSDEEP

1536:umAzsn5qsEgGnktdBpEgxQ7GIoTpg6SBNMlX22snxnBq1MfQVxcGifoMG1lh7G:uTsn5qsELktiGQ722lNfLJ6IyNr9

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_5a058837d9999de9f669dcda66ed1d31
- Size
  
  92KB
- MD5
  
  5a058837d9999de9f669dcda66ed1d31
- SHA1
  
  df675fda6651012df81f9959d040ddfaff160dcb
- SHA256
  
  24e62f812d15415d1f950f704da6e15da678b3a2e1315be2aa0d262f1e5425c5
- SHA512
  
  c643c85b03884639fa06e00a77b247adaa4f29601ad3bd7152c25780d45ff03016352d24bc1fb5afda14466629fff57eeffaa8eb5f022941642ca5abfab7a44e
- SSDEEP
  
  1536:umAzsn5qsEgGnktdBpEgxQ7GIoTpg6SBNMlX22snxnBq1MfQVxcGifoMG1lh7G:uTsn5qsELktiGQ722lNfLJ6IyNr9
Score

10^/10

pony credential_access discovery rat spyware stealer
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Pony family

Pony,Fareit

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10