pony | b25f64090144f614f5f58aa3a73c4c49f1d66f6923b3e13db71929e3f4ed9f59 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...bb.dll

windows7-x64

8

JaffaCakes...bb.dll

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_949e82d04b852e8aee5eed414e94f0bb
Size

408KB
Sample

250329-x4ylas1xcz
MD5

949e82d04b852e8aee5eed414e94f0bb
SHA1

b2b36085e51599ba638e55672fb443f2f24a463d
SHA256

b25f64090144f614f5f58aa3a73c4c49f1d66f6923b3e13db71929e3f4ed9f59
SHA512

cf8aa446c92377106ad18e0e6be396a1e662c95358618be3adfd42fd14c6543999df80e442958b40060906abeefd62fc8bcf9ab9c9a13944773f2182261ba1ad
SSDEEP

12288:4jt/ZlYzcVdYBkp6WDujLoyKysXAkvvFvL4qGoAYTXauy:agcPek44ufbKysXAkvvFvL4qGoAYTXau

Score

10^/10

pony credential_access defense_evasion discovery rat spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_949e82d04b852e8aee5eed414e94f0bb.dll

Resource

win7-20241023-en

defense_evasion discovery

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_949e82d04b852e8aee5eed414e94f0bb.dll

Resource

win10v2004-20250313-en

pony credential_access discovery rat spyware stealer upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_949e82d04b852e8aee5eed414e94f0bb
- Size
  
  408KB
- MD5
  
  949e82d04b852e8aee5eed414e94f0bb
- SHA1
  
  b2b36085e51599ba638e55672fb443f2f24a463d
- SHA256
  
  b25f64090144f614f5f58aa3a73c4c49f1d66f6923b3e13db71929e3f4ed9f59
- SHA512
  
  cf8aa446c92377106ad18e0e6be396a1e662c95358618be3adfd42fd14c6543999df80e442958b40060906abeefd62fc8bcf9ab9c9a13944773f2182261ba1ad
- SSDEEP
  
  12288:4jt/ZlYzcVdYBkp6WDujLoyKysXAkvvFvL4qGoAYTXauy:agcPek44ufbKysXAkvvFvL4qGoAYTXau
Score

10^/10

defense_evasion discovery pony credential_access rat spyware stealer upx
- Pony family
  pony
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Disables taskbar notifications via registry modification
  defense_evasion
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

ponycredential_accessdiscoveryratspywarestealerupx

© 2018-2025

Terms | Privacy