pony | 8d365ff837448a781fb851393d130d4c5df5ce90ea6223ac94fb4bd60c3966dd

Sharing

Copy URL Twitter E-mail

General

Target
Pony 2.2 Panel & Builder.rar
Size 2.6MB
Sample260817-t4v9dsem3w
SHA256 8d365ff837448a781fb851393d130d4c5df5ce90ea6223ac94fb4bd60c3966dd
MD5 6595fb1d0ad30771a39c18836ac23378
SHA1 eca93d232b00f7ef9bb254a1d8c8ecfd99d00117
SHA512 12f8418db222b2974fd43ab603ae26630bbcacf6c7109ae75e4693a6aa4c59aef0a8f5557a3f45a7e9fd44bcba242192ed7d62740d8098a22a758e481375bb1b
SSDEEP 49152:MdaNJiXp5PPhDdjjT6isep0VC5YNRmoPuS3AYfXQchV3TqDAqxmDj0hyNDxGaX7F:uaNJEjPddj10VC5YndPuSQY42V3eDDxy
TLSH
T1B3C51275CA2D3AFE75CEC51192694EC48AAA2F4DD1DA60D32A2E81458F1C0CDF0FF51A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Pony 2.2 Panel & Builder/builder/Builder.exe
- Size 32KB
- SHA256 9ee9c06c0ac2d053cbae65167513e1ad241a6d952d7672f923bfd9b221f48538
- MD5 85df7137538e6c3eb87976fec95d8e16
- SHA1 d5191d2d636544b05cd2faa14ef4d60e9c4a861f
- SHA512 55eef83e7dfeba4150566c5b410173fdb4b3b96d969f6466fd8dd2f80aec5f22510a1379e19faff4036d9910a6a46036a2c219225d775ab29461ca44d61f514e
- SSDEEP 384:aKDr6acgvJk0ZC2VYzqsGgaCCYyUcuVFg/DlEQc/KD:VJvJtC2zC4+Vgli
- TLSH
  T1DBE2D9338A284871FAD686B205B158F61523BC2254D1AD8B16C85E6C1D37ED3FAF472F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral1 behavioral2
- Target
  Pony 2.2 Panel & Builder/builder/packer.exe
- Size 384KB
- SHA256 af2a69732883c4cf3205a2e56d9f576b53785b539929c162c72d9e4e8679aa59
- MD5 4292c15c5bbe3cdad29ba03c0c89a737
- SHA1 65a6a7ab28b926e84eb6e4b7467e0af089844be8
- SHA512 917471c4464fda033492550118f8564c1d1d6deb4d66182b57982fea0e03229c65b15910ae1e9e925699a89ca4eaf886eeb9726347d70a478cc71f47bbe6b502
- SSDEEP 6144:ToS1VH0mKULjziPdf4HG8OVFbkcR2+85evDU5byEB5SuGI/dTZnEOseUrLh9rhrs:ToS1VH00fm5yOjpg+gekbZ3SWHPavo
- TLSH
  T1C78423335C08635AC11D02F99B65FF7EF496E48A51B3D5AA87DCDBFEDA9430422002B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Pony 2.2 Panel & Builder/builder/stub
- Size 90KB
- SHA256 7efdf3b1f7013680f3eff1aad5a2c5931c9efa41f6f2289d42c5046a6fa85000
- MD5 7ffd2758239e0991f9e9ccea49fc0341
- SHA1 a11ae66f9144870ad37b4700ea41b3fd05ed8282
- SHA512 bbea45feb4c2ab32ae5c2aa81a2c3ce96baf412006d5cfe42cffe689f8c394c579cf13478e6293429177565a3ee07beb00fd0f660bf570259bb91b36ab3c20b2
- SSDEEP 1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIbkzmt2l:2SnMuGc/CfZDap6COU45EIjtm
- TLSH
  T125930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery execution pony rat spyware stealer
- Family: Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6
- Target
  Pony 2.2 Panel & Builder/panel/404.html
- Size 348B
- SHA256 7cc79432ea8ef9c1f7eb89e8f90985f00b6916fa938156f3ce42643d5878933c
- MD5 91cc4c0c0e03d9bc0be30142d06fce05
- SHA1 f8f636eba50494bfdf77352d9f77218e5a825ded
- SHA512 78d4c586cf69c731b47cef576d175c99c6395fe77aed07ce10b766db35dfbbee26dfbee2ae692b425775cdd5c1aa1836cd376dd4040c49e7c3709e2441e1f777
- TLSH
  T147E0787F93422D0741B1467434C1F1D1414B2352B12905546D40747F3F5562CC1D33D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Pony 2.2 Panel & Builder/panel/admin.php
- Size 62KB
- SHA256 01f5647c4d3224778f89cdc3be24c3cdee4bdcfd90cc064abfa84ad6b6ade780
- MD5 c8c64af651c2f07bd2620666aa7317c4
- SHA1 0575d31bfce1f687dbeb548ad974150ee6f21837
- SHA512 0258d7f60774a7389ce1c1f1c72fdd72a8dcd8430b8074104c833a7e7a526e57152cb656b10a6c896d6532c18f97ec5bf495c0bfd2b5e95a3c6888d2fb9cb3b2
- SSDEEP 1536:Tx2UOvsZbxesZF+pu8Y5Gy719VOJVUVoV1lZpU9jqZNvWZPMbq:Tx2UO0ZbxesZF+DJVUVoV1lPU9+ZNvW3
- TLSH
  T1C7530F662CEB25A349F3D0FE639B6856E126C0075440C9227E3CD3C86F61D9ADDFD298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/Smarty.class.php
- Size 45KB
- SHA256 713c0b44a2346f8a708a6ee9aa3aa62fbb08b1298377d01c2c097af43c93efe6
- MD5 4519383063821945547d49d9a8a62039
- SHA1 efa93f1c42ac140051bec2f39e37aa8d8349c29a
- SHA512 9b4ff185b17844df38608f4e3c5ae583c5f1d6be09f49b9607528ee7485c46d797da800c76d593b74a82b4e346c16df8f3ea70a38179bb1298b2405167937919
- SSDEEP 768:1uSk9FKLsj6grnFPfez1+sV/dR2EdNZpgJZ/jcqyicQLdF64ZatZIM:1Eb0sj6UFPfez1+sVlR2Ed/pgJZ/wHQO
- TLSH
  T1D723741429FF99731133247CA34E9081D126D21B2B1994C27DEE73745F92F28C7B6ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/SmartyBC.class.php
- Size 12KB
- SHA256 0d2127976053d52d914a2cd2770986686cfc0319569c0c41ec5035e7e137ccfb
- MD5 967c1b2bdc8a2a2512eac85b40f1f3cd
- SHA1 3afd69566489c695f894f6f0d550e7ab6b7a50ce
- SHA512 f01606e66f2c1264e9e392c70e2dcd26da4cbe72a17b37e1ede2805aee2cc57027dda05c9835c0725cb9f1f63728b3adcb1b84aac4eff7d6063ab0ddda82e7ed
- SSDEEP 192:JuSkaB2L36CpVDeP3nZcFXVWbCoIEabJ7jbii+Oa30KWbBonJapxEVbjYAWajRc2:JuSkaA6mSPXZcxPdCd6GOQ
- TLSH
  T14B42AD2D69F8B9630563707CA74B9084C432921B379524D1B5DEABF49F26B3CCA22D2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.fetch.php
- Size 7KB
- SHA256 5a2c3e5dc7bef3c6f98d971de4bd52e3d46cdb4d9560c37328401a4f38cc5519
- MD5 aa8c2a12805c65eb7377dbeafabd9df2
- SHA1 811578f8d672cbed2ffae8439e50a4d17307d6ff
- SHA512 b10dcf124a3cab8479fed456d40c3d1049c2d02b5b59217bc3cff1e7a44c636917c9d87b469aaa3f61b9fc7b32be2eebf057f52534ce56d30afe2e9b8f3446f4
- SSDEEP 192:uY8A2OWGyfLNW99Hh12muFy6W+ia6+yCec+HPtCSVZ0C3vFZn/Q:uY8IFYk3Tno
- TLSH
  T1E0F1001898AB50E641AFF83C5BDEA10CFA1D4843300ADD46BC9C97949F9C43687F4BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.html_table.php
- Size 5KB
- SHA256 7c009d89036c4d96f646f6615f4681beeb9a290a0f05f8448a8b49370293f205
- MD5 0589173454ae896e5ffb90d8b3045eee
- SHA1 f521bbcfc39cf70f027dbc533cddd70340ac889b
- SHA512 71204339f0311e99cfa8a8acd20d2d1d61573939c6cf5fad3655b088220c51e51a7e55a6cb02a40703c59f24858c85ef73b123315a602d6f5eda115239f32bb0
- SSDEEP 96:uEx6TRd7mFVoJUQXY6122xf2QVIqyWZMx7XXP8AeIyOkNc:uEMfgf61hxf2kIqyWZMx7XXP8AJyOkNc
- TLSH
  T1F8B1A72874BF205A5883902553CFD49558A988132009E8E6FD8DCBC7AFF6936C1EDF8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.mailto.php
- Size 5KB
- SHA256 3dd83fbe30f0c1ecfc7f5797435247c4d097b66584a8cd002aaf084877900261
- MD5 a495d34af3a16aa205e71c3ccc521dbc
- SHA1 c758c38e494e687fcb59553e799e7eb8ef96c3bf
- SHA512 371dd189d383428f1d34bbd139790bd681ed265b195ec452a430fd935346f7a34e1cee8958394c402f04570a4f56a928496012c63b97a51731d6863a45066886
- SSDEEP 96:uwNwf9jAIFot/skjQA9ayUzQXJC4RrEyKFm:uwNSVkjQAh9XI4Kyh
- TLSH
  T1AFB1511969A2919048E3952062DFD02CC4FD70E3BA08E9E8BCDD93D59FD8F75CC60D64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.math.php
- Size 2KB
- SHA256 34124a01ba7174a91a6b1f177c01e274f25d16f0971af4cd46e7dcbb51b24743
- MD5 235410a5d2cc1f1236d9d4dc0a0f2e9c
- SHA1 b9b70c55a7d5a32f81381ef9f65e408580bb6450
- SHA512 89f8b645d0fe033d0dc62428f8847a6b059f83fd1ac7fef3a618ef2f9c7b8d882d45521e5c5081ce457c80c3472d1997a9c4b603541b0c6295c8c777960a474b
- TLSH
  T11F51509478B291B284BB627C67ED0008CE7C14077E9A8A767ACD27602F5CD3E8775F90
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.paginate_first.php
- Size 2KB
- SHA256 25da2fcf4dde1470aab8763b7ed1878c84491d0b79634ce449176b1272b3fe93
- MD5 ade046cc45c2e80df01f2a572ffff78e
- SHA1 9eea893edb2492e4381d73435dad029f685e4801
- SHA512 324460b0f731e357cfc8ea3ac85a41329407bb05f90181b05025ac768b6bb611f10640c1de20327bd823ecfa81d1d98f00cbe2694955389c6828500075387034
- TLSH
  T1E0515358115351A30B972678238A9255829E96473591CE41784CA3E5CFC4F268BB8FFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.paginate_last.php
- Size 2KB
- SHA256 198489cf7f804c0f66f33e6654828c1e535e0e52121b527139a56d54cdd6c1b7
- MD5 0d00a9f945c38462d127f8cf692773ca
- SHA1 97bf4ac72ffe3e035062f566d4bba6919da8a320
- SHA512 2d575779efa11e00090904b71e8b755bcb818604900d22de1edf3a373c29f0592fa9ef60fed23bbc381339169e4da23d7b7f557631bbceaee818d2928c14175a
- TLSH
  T1D4517458114311B357971279138AA26446EA95473691CE017C8CA3D6CFC8F26CBF8FBE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.paginate_middle.php
- Size 4KB
- SHA256 373b7317f72fa9fbe783d4b501585e2f6f5886927028f27c0ddced47dc1c0493
- MD5 1b6a560ce999f040c26d9fe9eb31585a
- SHA1 0e9679c867a4e160ef1f6ce49bb20cf338f26bee
- SHA512 a4376ceda30678bc527aca7c3a35d2c8f6feaf36a235428d0d78f7329cb676feeb4d90c4aacfdeead7e65cff23c639a1831f3d7cafe166197d900bd0e65ca11d
- SSDEEP 96:ZuS46yNdXq4Binwm2i0b+KDSbCabRq1YIGq:ZuS4Tva4BinwJTb+KDSbjbRq1YIGq
- TLSH
  T1B8A10174605365A2D76B213D27CEA21458B6C4176550CE02BECCA3C1DFCCFA287B9B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.paginate_next.php
- Size 2KB
- SHA256 6e576a6db5c655fa210d674468d992f5e46b6c55909672cb4a9589d23d3df2a3
- MD5 619c67b62478d9a803576b1094c0169e
- SHA1 e671be3952ddab1b9af7d99b4322ca83d45e9193
- SHA512 955900bc05441a02f576dc2e0360a3750d03694fce3454ef3f69ef6d53b1ba24a7cbbfe1c0ed70137d175594679a995f82f5c97f65fbb7b6420a85aa0cfbac27
- TLSH
  T1A851419C515351A347AB227813899354819A89473690CE527C8CA2E5CFC4F6ACFF8FFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Pony 2.2 Panel & Builder/panel/includes/Smarty-3.1.15/libs/plugins/function.paginate_prev.php
- Size 2KB
- SHA256 91a43ab3eaf44a02894f24fa6f8547b30821ed82d07fdb89e05918ace209be45
- MD5 08cc552d1609b27827f097588d54dc33
- SHA1 bab43f1ac2075c55751dadc1685daa5817e21924
- SHA512 25bcf5dd727d85cf5a7fa8b1cb57939a8865d3b48a6c7e91c352689f3125219d367dad58a63b659b5efea836b632ebbbe4e8d4e9e334745c2a36ebc7ba4e38bc
- TLSH
  T1A45130AC514351A34797227C23899354819A99473690CE127C4CA6E9CFC4B7A8FB8FFA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Pony,Fareit

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32