General

  • Target

    9F2E38DB951CFD63D36C48BD04BA0AB9.exe

  • Size

    220KB

  • Sample

    210704-31vpckgsrn

  • MD5

    9f2e38db951cfd63d36c48bd04ba0ab9

  • SHA1

    4de4d4d204b9aa835a5113368fc17d3fe11011ba

  • SHA256

    d3fc1e644cd5bf4cd9890d0a6ae300dc96fd8c72fc6455a329437cc69e4cf0a1

  • SHA512

    98734dfe8ee726a2f48596a1852963c3d5de9e69648cd02f8c78e6bb303883f03867f6db3dc55b3aeaf0c760ff1679befe03f30c05bb0a1d636655d304d91691

Malware Config

Extracted

Family

pony

C2

http://aasdasd.com/gt.php

http://cent1.fav.al/st/gate.php

Targets

    • Target

      9F2E38DB951CFD63D36C48BD04BA0AB9.exe

    • Size

      220KB

    • MD5

      9f2e38db951cfd63d36c48bd04ba0ab9

    • SHA1

      4de4d4d204b9aa835a5113368fc17d3fe11011ba

    • SHA256

      d3fc1e644cd5bf4cd9890d0a6ae300dc96fd8c72fc6455a329437cc69e4cf0a1

    • SHA512

      98734dfe8ee726a2f48596a1852963c3d5de9e69648cd02f8c78e6bb303883f03867f6db3dc55b3aeaf0c760ff1679befe03f30c05bb0a1d636655d304d91691

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks