General

  • Target

    fa56997241374c1642e537fad8f447bf42821545a13799ac9595e59399ac5f84.exe

  • Size

    388KB

  • Sample

    220521-yhy6dagcar

  • MD5

    b58eb4671823a88610c20e907c5a6841

  • SHA1

    e98ccb390845fe4b37efa8da06bde419774a6773

  • SHA256

    fa56997241374c1642e537fad8f447bf42821545a13799ac9595e59399ac5f84

  • SHA512

    94cbcaed18b039673868f5bcd3d3f7c77fba217c829b975735ce80ef1b2f09338f33334bfc3bd0f61049eaab242b7aba728c2a0b6028676e532f0a9454061063

Malware Config

Extracted

Family

pony

C2

http://nowahost.ru/sprygin.ru/inc/gate.php

Targets

    • Target

      fa56997241374c1642e537fad8f447bf42821545a13799ac9595e59399ac5f84.exe

    • Size

      388KB

    • MD5

      b58eb4671823a88610c20e907c5a6841

    • SHA1

      e98ccb390845fe4b37efa8da06bde419774a6773

    • SHA256

      fa56997241374c1642e537fad8f447bf42821545a13799ac9595e59399ac5f84

    • SHA512

      94cbcaed18b039673868f5bcd3d3f7c77fba217c829b975735ce80ef1b2f09338f33334bfc3bd0f61049eaab242b7aba728c2a0b6028676e532f0a9454061063

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks