General

  • Target

    AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe

  • Size

    132KB

  • Sample

    211028-t4ss9sgfgl

  • MD5

    7da0c504b12418fb839d87140818db86

  • SHA1

    62df5ab21fdce64587af336036b7415842ee8eaa

  • SHA256

    ac71a4c514e59461dc4987a54704e1f1d7e9dced054acfca7758d55cc8e4964f

  • SHA512

    a90d34045ad7f2c785b8e795250004874c08908e26143cfe667f2f1d899b8d85eddcc978ee3d150df3225983e1c9e8d8bfb0111982017ef3d43269a1af30dd47

Malware Config

Extracted

Family

pony

C2

http://yourdentalfirst.com/wp-includes/SimplePie/SimplePie.php

http://zoemeiresort.com/wp-includes/pomo/pomo.php

http://www.hummingbirdhamlet.com/wp-content/upgrade/upgrade.php

http://www.icleanthescene.com/wp-content/blogs.dir/blogs.dir.php

http://www.iconicglam.com/wp-admin/network/extension.php

http://www.neapolismessina.com/_oldsite/imggallery/lxpxj.php

http://www.realdealutah.com/wp-contents/themes/themes.php

http://www.techsiara.com/wp-includes/SimplePie/SimplePie.php

http://aycenergy.com/wp/wp-admin/navigation.php

Targets

    • Target

      AC71A4C514E59461DC4987A54704E1F1D7E9DCED054AC.exe

    • Size

      132KB

    • MD5

      7da0c504b12418fb839d87140818db86

    • SHA1

      62df5ab21fdce64587af336036b7415842ee8eaa

    • SHA256

      ac71a4c514e59461dc4987a54704e1f1d7e9dced054acfca7758d55cc8e4964f

    • SHA512

      a90d34045ad7f2c785b8e795250004874c08908e26143cfe667f2f1d899b8d85eddcc978ee3d150df3225983e1c9e8d8bfb0111982017ef3d43269a1af30dd47

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • suricata: ET MALWARE Fareit/Pony Downloader Checkin 2

      suricata: ET MALWARE Fareit/Pony Downloader Checkin 2

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Tasks