pony | c2ca01566604f65412cce35dbbb74d4feac15c2bad530db626706f8e8c692315

General

Target
2026-11-02_b1d98d88f1c8e069c09d11e484bb018a_elex_wannacry
Size 200KB
Sample261103-bpy3magx4j
SHA256 c2ca01566604f65412cce35dbbb74d4feac15c2bad530db626706f8e8c692315
MD5 b1d98d88f1c8e069c09d11e484bb018a
SHA1 a3ff22792bef125a5b2a1278d76cf72dd1d2cf12
SHA512 7fa6bd6ec3d673eb84d07227916dfef99f737ff65d6eec1a064b317a64065d65034f46c07d9d6b29940a67f6e07f1ff62aad3b55e9e30a240e31b6c2adbe461e
SSDEEP 3072:Dqah/lsy+EH6iBfwmOh0H8oEv2+yrYmqrxBxXu1:mU/lsy+Eh1Bm8XqHx+1
TLSH
T1E21406B5A420343FCF31C33176E80C9B4F944B295AB6085BF81788E95FE35568647EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-02_b1d98d88f1c8e069c09d11e484bb018a_elex_wannacry
- Size 200KB
- SHA256 c2ca01566604f65412cce35dbbb74d4feac15c2bad530db626706f8e8c692315
- MD5 b1d98d88f1c8e069c09d11e484bb018a
- SHA1 a3ff22792bef125a5b2a1278d76cf72dd1d2cf12
- SHA512 7fa6bd6ec3d673eb84d07227916dfef99f737ff65d6eec1a064b317a64065d65034f46c07d9d6b29940a67f6e07f1ff62aad3b55e9e30a240e31b6c2adbe461e
- SSDEEP 3072:Dqah/lsy+EH6iBfwmOh0H8oEv2+yrYmqrxBxXu1:mU/lsy+Eh1Bm8XqHx+1
- TLSH
  T1E21406B5A420343FCF31C33176E80C9B4F944B295AB6085BF81788E95FE35568647EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access discovery execution pony rat spyware stealer
- Family: Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  Detects executables referencing many file transfer clients. Observed in information stealers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2