General

  • Target

    1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41

  • Size

    96KB

  • Sample

    221002-rem6dahhg7

  • MD5

    6c84be59f2fd20c2dd456fca1bc708e0

  • SHA1

    40d9df8edd1370c713ff6d51f72e06af1bdb8588

  • SHA256

    1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41

  • SHA512

    647d0bba85227578983a54bfa76d548c448060f94938b7f03c9bae3fc1c50fcab878befb1098f8709c2fb791a5e957ca6979ea93649961afecd36ee61e3ab969

  • SSDEEP

    1536:aLU1TgMHAF6C1QC5s2DnTFwpnP8WSSQgOtSG3h3IR6mTBAUmzzcUOUhXFen/:J15nC5rbTupPwPI6tIR6mTBqdbL

Malware Config

Extracted

Family

pony

C2

http://zkhmeps.pw:4915/doc/black.php

http://zkhmeps.pw:888/doc/black.php

Attributes
  • payload_url

    http://ckirmpu.pw:888/pic/Flash.exe

Targets

    • Target

      1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41

    • Size

      96KB

    • MD5

      6c84be59f2fd20c2dd456fca1bc708e0

    • SHA1

      40d9df8edd1370c713ff6d51f72e06af1bdb8588

    • SHA256

      1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41

    • SHA512

      647d0bba85227578983a54bfa76d548c448060f94938b7f03c9bae3fc1c50fcab878befb1098f8709c2fb791a5e957ca6979ea93649961afecd36ee61e3ab969

    • SSDEEP

      1536:aLU1TgMHAF6C1QC5s2DnTFwpnP8WSSQgOtSG3h3IR6mTBAUmzzcUOUhXFen/:J15nC5rbTupPwPI6tIR6mTBqdbL

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks