General

  • Target

    ac6a43c959830b9abc7427807a6a938846b23cfab0d4f2b206d828461520d45f

  • Size

    137KB

  • Sample

    221001-2ach7abbfn

  • MD5

    78f560e9132a48714adaa0b04f8041e2

  • SHA1

    bcbbd2a932a789d712d6474a1712e2fc84bcce91

  • SHA256

    ac6a43c959830b9abc7427807a6a938846b23cfab0d4f2b206d828461520d45f

  • SHA512

    f38282a62b70f30d4ba25ded9bae031061222a9df3da51373214271bfb2fb05e1862028d72332466deaa98d1f7c5be4fedff31a89c3d6d0149ea7c604a97e9a2

  • SSDEEP

    3072:XxqhijEGPYGExVqky4Oj4Y2FsjVjoyjMxZNsIp:XE4EGPJqVqkgcYpjHMfN/p

Malware Config

Extracted

Family

pony

C2

http://ripnhuipn.ru/ppp/gate.php

Attributes
  • payload_url

    http://dave.www.ontera.net/Pnu7U1j.exe

    http://prccusa.com/Xb8agZ.exe

    http://207.204.5.170/FrcA9vg.exe

Targets

    • Target

      ac6a43c959830b9abc7427807a6a938846b23cfab0d4f2b206d828461520d45f

    • Size

      137KB

    • MD5

      78f560e9132a48714adaa0b04f8041e2

    • SHA1

      bcbbd2a932a789d712d6474a1712e2fc84bcce91

    • SHA256

      ac6a43c959830b9abc7427807a6a938846b23cfab0d4f2b206d828461520d45f

    • SHA512

      f38282a62b70f30d4ba25ded9bae031061222a9df3da51373214271bfb2fb05e1862028d72332466deaa98d1f7c5be4fedff31a89c3d6d0149ea7c604a97e9a2

    • SSDEEP

      3072:XxqhijEGPYGExVqky4Oj4Y2FsjVjoyjMxZNsIp:XE4EGPJqVqkgcYpjHMfN/p

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks