General

  • Target

    c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

  • Size

    225KB

  • Sample

    221001-3sqn7sdffk

  • MD5

    57a9a1489abff9bf710a6449f627a7ec

  • SHA1

    b78147c9cb333dfc4dcab39309808dded9eaabe5

  • SHA256

    c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

  • SHA512

    4fe2722b84dd47c309d8bf161e5df97d976a9bead33efad16b17abbbc388da4bd0ebbab7fee716e912b0a44604a3f74ddb9bccaf46a994fa4f5e4cc691bea2e9

  • SSDEEP

    3072:4VSKIWJOOuepNUnzLBitqnHBXo/f+QqfABAh6S1/Z7i/e5rdUtYN8FK/qjoOzjNK:aJwepKnzLnpzQAABAh6SXrvKFZjN

Malware Config

Extracted

Family

pony

C2

http://sunbulahqroup.com/tobo/Panel/gate.php

http://www.sunbulahqroup.com/tobo/Panel/gate.php

Targets

    • Target

      c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

    • Size

      225KB

    • MD5

      57a9a1489abff9bf710a6449f627a7ec

    • SHA1

      b78147c9cb333dfc4dcab39309808dded9eaabe5

    • SHA256

      c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

    • SHA512

      4fe2722b84dd47c309d8bf161e5df97d976a9bead33efad16b17abbbc388da4bd0ebbab7fee716e912b0a44604a3f74ddb9bccaf46a994fa4f5e4cc691bea2e9

    • SSDEEP

      3072:4VSKIWJOOuepNUnzLBitqnHBXo/f+QqfABAh6S1/Z7i/e5rdUtYN8FK/qjoOzjNK:aJwepKnzLnpzQAABAh6SXrvKFZjN

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks