General

  • Target

    b9d77dd3e343cf4baea654620017b25078fb9503874fe0bba2f2ff123bc6f968

  • Size

    152KB

  • Sample

    221119-hg8qesdc5s

  • MD5

    1e8496eaad929b5763b3a16b4f42c926

  • SHA1

    b45fd9162ec05493c51f7682eb1723679a2bb88a

  • SHA256

    b9d77dd3e343cf4baea654620017b25078fb9503874fe0bba2f2ff123bc6f968

  • SHA512

    b21c29efc2d3ea6510c587c560dd3612b9a740925b4f0f6becb37519e7d4183f25bbce65d287865f1e7235c28dde0882c8a468f1d6a0e70f59e8028beca41339

  • SSDEEP

    3072:neY7IOeFnCofEM4zhXjjW67r9MTWVwMg1lY:nn7/WyVWqJrgk

Malware Config

Extracted

Family

pony

C2

http://greatworks-inc.in/ppnngrr/gate.php

http://relax-and-health.com/ppnngrr/gate.php

http://mazda-corpinc.biz/ppnngrr/gate.php

Targets

    • Target

      b9d77dd3e343cf4baea654620017b25078fb9503874fe0bba2f2ff123bc6f968

    • Size

      152KB

    • MD5

      1e8496eaad929b5763b3a16b4f42c926

    • SHA1

      b45fd9162ec05493c51f7682eb1723679a2bb88a

    • SHA256

      b9d77dd3e343cf4baea654620017b25078fb9503874fe0bba2f2ff123bc6f968

    • SHA512

      b21c29efc2d3ea6510c587c560dd3612b9a740925b4f0f6becb37519e7d4183f25bbce65d287865f1e7235c28dde0882c8a468f1d6a0e70f59e8028beca41339

    • SSDEEP

      3072:neY7IOeFnCofEM4zhXjjW67r9MTWVwMg1lY:nn7/WyVWqJrgk

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks