pony | 0051fcd73bd3ebf8c5657b960e5ff08d1cb00e87d31f770a2227d7822b82a3e8 | Triage

Sharing

General

Target

JaffaCakes118_012751015791ac3e270276707467ef58
Size

90KB
Sample

250121-bxf7sayrgn
MD5

012751015791ac3e270276707467ef58
SHA1

7f7b18d983fc15c75fe7d86216be2e5aebe95722
SHA256

0051fcd73bd3ebf8c5657b960e5ff08d1cb00e87d31f770a2227d7822b82a3e8
SHA512

eca33c6f7d4d4faa715eff32b9ba1c43227952df29c0d9b1e31de618023a468a76f1e92ba0c68b641288afa24da2d0fd7d30a02b40f8b5e63e9e1ed98c45cc99
SSDEEP

1536:4Tz3OcSNTqTlBV7s75OLuz3JU2pdiustaLloOFkeCTvSEyBkzZt6Z:YrmN7OLuz3e2pEhtOFD5Eyqt6Z

Score

10^/10

pony collection credential_access discovery rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://4.professionalsoft.com/ponyd/gate.php

http://4.promatika.com/ponyd/gate.php

Attributes

payload_url
http://ftp.sveikasdumas.lt/9oQB5YNa.exe

http://sol-electrica.com/dbsQ.exe

http://stockinter.intersport.es/MU4jW3pk.exe

http://europadesign.altervista.org/MVAAJ.exe

http://healthblognetworks.com/Nt5p7X.exe

http://energy-without-carbon.com/YPHHERQ.exe

http://frenchhairstudio.com/t66MT6.exe

http://efumi.bokunenjin.com/wXQy.exe

Targets

- Target
  
  JaffaCakes118_012751015791ac3e270276707467ef58
- Size
  
  90KB
- MD5
  
  012751015791ac3e270276707467ef58
- SHA1
  
  7f7b18d983fc15c75fe7d86216be2e5aebe95722
- SHA256
  
  0051fcd73bd3ebf8c5657b960e5ff08d1cb00e87d31f770a2227d7822b82a3e8
- SHA512
  
  eca33c6f7d4d4faa715eff32b9ba1c43227952df29c0d9b1e31de618023a468a76f1e92ba0c68b641288afa24da2d0fd7d30a02b40f8b5e63e9e1ed98c45cc99
- SSDEEP
  
  1536:4Tz3OcSNTqTlBV7s75OLuz3JU2pdiustaLloOFkeCTvSEyBkzZt6Z:YrmN7OLuz3e2pEhtOFD5Eyqt6Z
Score

10^/10

pony collection credential_access discovery rat spyware stealer
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ponycollectioncredential_accessdiscoveryratspywarestealer

behavioral2

ponycollectioncredential_accessdiscoveryratspywarestealer