General

  • Target

    ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a

  • Size

    112KB

  • Sample

    221003-a6mv9ahef2

  • MD5

    4eb3b705f4668a832cdc52e78a4e4361

  • SHA1

    41eba9d1afe41032b9bb9dd948148aefbe804f18

  • SHA256

    ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a

  • SHA512

    f08175e76ad7ac014f51897a3472d18195a24b3be5ca9a11af1b754834f4fd17c7976e8d0a6766e6d48c9f023deb353a692b8a4df6026c8d45cfebe269c303d4

  • SSDEEP

    3072:Cj3eTCAUHXpzhkFMMpqjRJOuyUWY8PoN58s:Cj3eWLsFwjauf

Malware Config

Extracted

Family

pony

C2

http://seolinkmarket.com/idx.php

http://liststitch.com/link.php

http://closedir.com/hotlink/img.php

http://closedir.com/hotlink/pics.php

Targets

    • Target

      ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a

    • Size

      112KB

    • MD5

      4eb3b705f4668a832cdc52e78a4e4361

    • SHA1

      41eba9d1afe41032b9bb9dd948148aefbe804f18

    • SHA256

      ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a

    • SHA512

      f08175e76ad7ac014f51897a3472d18195a24b3be5ca9a11af1b754834f4fd17c7976e8d0a6766e6d48c9f023deb353a692b8a4df6026c8d45cfebe269c303d4

    • SSDEEP

      3072:Cj3eTCAUHXpzhkFMMpqjRJOuyUWY8PoN58s:Cj3eWLsFwjauf

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Tasks