General

  • Target

    13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53

  • Size

    113KB

  • Sample

    221002-k6w42aabbj

  • MD5

    4c7ab08d754009d3da33567beb21f536

  • SHA1

    0cc800272ad9fc776c255bb4c1961e312c7e6912

  • SHA256

    13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53

  • SHA512

    f8fd41fc988007b5f398f2e4b7a2c4b92f8845a35a7db6379113a08a41e118252fde224c6cfae4d44264267a82c88aafe22f6ebf9611aefff093cc1d29e62707

  • SSDEEP

    3072:Rd2KQcvvnqShZpr+mybhKbH34F1hqJSBy:s2nqSp+mcwbHIsgy

Malware Config

Extracted

Family

pony

C2

http://82.146.37.129/ppp/ta.php

Attributes
  • payload_url

    http://82.146.39.221/p2p/1.exe

Targets

    • Target

      13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53

    • Size

      113KB

    • MD5

      4c7ab08d754009d3da33567beb21f536

    • SHA1

      0cc800272ad9fc776c255bb4c1961e312c7e6912

    • SHA256

      13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53

    • SHA512

      f8fd41fc988007b5f398f2e4b7a2c4b92f8845a35a7db6379113a08a41e118252fde224c6cfae4d44264267a82c88aafe22f6ebf9611aefff093cc1d29e62707

    • SSDEEP

      3072:Rd2KQcvvnqShZpr+mybhKbH34F1hqJSBy:s2nqSp+mcwbHIsgy

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Tasks