pony | b886fc9e1015acb5f5a18a7eefbbca7d8569e74f7deac5735caeeafd90326a2f | Triage

Sharing

General

Target

b886fc9e1015acb5f5a18a7eefbbca7d8569e74f7deac5735caeeafd90326a2f.exe
Size

2.2MB
Sample

250116-nnf7msyjdz
MD5

746706c29930047b9b74ff25ee291dbb
SHA1

818249805c6fa6790c84713313c6c271f329f7bb
SHA256

b886fc9e1015acb5f5a18a7eefbbca7d8569e74f7deac5735caeeafd90326a2f
SHA512

f6c197e1325969b5ec7ba78a84cf5c0b43f3e3ffdb50c466a8f69fbbe8f16447ce8f71eb9210c5d9f6b216d01f42460e173d579817759accd0912f5bd2911339
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwR

Score

10^/10

pony discovery

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  b886fc9e1015acb5f5a18a7eefbbca7d8569e74f7deac5735caeeafd90326a2f.exe
- Size
  
  2.2MB
- MD5
  
  746706c29930047b9b74ff25ee291dbb
- SHA1
  
  818249805c6fa6790c84713313c6c271f329f7bb
- SHA256
  
  b886fc9e1015acb5f5a18a7eefbbca7d8569e74f7deac5735caeeafd90326a2f
- SHA512
  
  f6c197e1325969b5ec7ba78a84cf5c0b43f3e3ffdb50c466a8f69fbbe8f16447ce8f71eb9210c5d9f6b216d01f42460e173d579817759accd0912f5bd2911339
- SSDEEP
  
  24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwR
Score

7^/10

discovery
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2