pony | aa96e5d2733c99c712a78d3af30cc5fe83bb2aad00d5061c5e287cf7d91c2391 | Triage

Sharing

General

Target

aa96e5d2733c99c712a78d3af30cc5fe83bb2aad00d5061c5e287cf7d91c2391.exe
Size

2.2MB
Sample

250120-bxnxmavpcr
MD5

bcf5559020787f325c89ab5a51e24e2b
SHA1

5132b44f2cc8c7c223ab4406825de6d9b0b9122a
SHA256

aa96e5d2733c99c712a78d3af30cc5fe83bb2aad00d5061c5e287cf7d91c2391
SHA512

0f1e505ef4d96a7265596feb34b3b85f2b18ba786b339cf4f7276b25aea4a9ce1f54a176aaf66b127e1d814386c1151f65ff7ec875c1fcb9c62a2a3eb3209988
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWwwP

Score

10^/10

pony discovery

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Targets

- Target
  
  aa96e5d2733c99c712a78d3af30cc5fe83bb2aad00d5061c5e287cf7d91c2391.exe
- Size
  
  2.2MB
- MD5
  
  bcf5559020787f325c89ab5a51e24e2b
- SHA1
  
  5132b44f2cc8c7c223ab4406825de6d9b0b9122a
- SHA256
  
  aa96e5d2733c99c712a78d3af30cc5fe83bb2aad00d5061c5e287cf7d91c2391
- SHA512
  
  0f1e505ef4d96a7265596feb34b3b85f2b18ba786b339cf4f7276b25aea4a9ce1f54a176aaf66b127e1d814386c1151f65ff7ec875c1fcb9c62a2a3eb3209988
- SSDEEP
  
  24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWwwP
Score

7^/10

discovery
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2