General

  • Target

    971443aa3efcab7657935b3346d329d957612209f634bbda0203376dddf15512.exe

  • Size

    240KB

  • Sample

    220521-yhzf5sgcbl

  • MD5

    5a55e6c092cf553188e2f6d8beefe93f

  • SHA1

    e273a97c430dff0097d37417c302f46fc6a85027

  • SHA256

    971443aa3efcab7657935b3346d329d957612209f634bbda0203376dddf15512

  • SHA512

    02ca726dcf1158777fb6398d2af1b2bba7a51d6e3378079bfa1ed631fe0bb28ff92e07ca566021493bcf800c5adb95dec44a9c550849f664aff20e640e6e869b

Malware Config

Extracted

Family

pony

C2

http://azbex.com/sydney/panelnew/gate.php

Targets

    • Target

      971443aa3efcab7657935b3346d329d957612209f634bbda0203376dddf15512.exe

    • Size

      240KB

    • MD5

      5a55e6c092cf553188e2f6d8beefe93f

    • SHA1

      e273a97c430dff0097d37417c302f46fc6a85027

    • SHA256

      971443aa3efcab7657935b3346d329d957612209f634bbda0203376dddf15512

    • SHA512

      02ca726dcf1158777fb6398d2af1b2bba7a51d6e3378079bfa1ed631fe0bb28ff92e07ca566021493bcf800c5adb95dec44a9c550849f664aff20e640e6e869b

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks