General

  • Target

    95abbcfb61b8cde05f69a06e1fc4e2ee1fe26635a1a352730878f043f86af103

  • Size

    34KB

  • Sample

    221028-2qskcaback

  • MD5

    b584116bdf327df5eec290aa3ef69103

  • SHA1

    62942105ac9cac9f8efdba76725848fd7788ab94

  • SHA256

    95abbcfb61b8cde05f69a06e1fc4e2ee1fe26635a1a352730878f043f86af103

  • SHA512

    590c8d26de7ea296a365f8975c0309977f1c92612246531ca8616fc19b64a3aa8597697ea709456a35fa9ef63e067eeccbf917d6bcbe7a301e1822cf0cdce1c9

  • SSDEEP

    768:cwQ1t8dRamt9Ys823a39DjDq+wQt6Hvlies8jg+I/exm1R4K:FQPgamt9N3CmfRHvlxs8lI2c1RN

Malware Config

Extracted

Family

pony

C2

http://www.melodyhymns.com/Z1/bigmac/gate.php

Targets

    • Target

      95abbcfb61b8cde05f69a06e1fc4e2ee1fe26635a1a352730878f043f86af103

    • Size

      34KB

    • MD5

      b584116bdf327df5eec290aa3ef69103

    • SHA1

      62942105ac9cac9f8efdba76725848fd7788ab94

    • SHA256

      95abbcfb61b8cde05f69a06e1fc4e2ee1fe26635a1a352730878f043f86af103

    • SHA512

      590c8d26de7ea296a365f8975c0309977f1c92612246531ca8616fc19b64a3aa8597697ea709456a35fa9ef63e067eeccbf917d6bcbe7a301e1822cf0cdce1c9

    • SSDEEP

      768:cwQ1t8dRamt9Ys823a39DjDq+wQt6Hvlies8jg+I/exm1R4K:FQPgamt9N3CmfRHvlxs8lI2c1RN

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks