General

  • Target

    79fd71ef4c7fbc43cf914ec82d00056f9e3b8812e2589717f265f3c7623f2606

  • Size

    96KB

  • Sample

    221120-kae6msea55

  • MD5

    3c658c1945c067468d8f79db07643e90

  • SHA1

    84510320b162e4023406d928f0a301e082ef4269

  • SHA256

    79fd71ef4c7fbc43cf914ec82d00056f9e3b8812e2589717f265f3c7623f2606

  • SHA512

    d19737c15fb5bcd2187cf3bbc7fe6ea65bdf4bfacb16c00b86862e3124484c450a1e54fcdf5b9a454187bb2133b27a7e43c8e49a516b327b10fc863d400632d6

  • SSDEEP

    1536:bNOLSWhnirjfpNGLsmYTQssZiFFvVQwoQy0+47XvcW2svXlrtkt99933Jn:5Ox2jxYYnQ5OCwooUsv94J

Malware Config

Extracted

Family

pony

C2

http://mgirrdu.pw:4915/way/like.php

http://jtryliy.pw:4915/way/like.php

Targets

    • Target

      79fd71ef4c7fbc43cf914ec82d00056f9e3b8812e2589717f265f3c7623f2606

    • Size

      96KB

    • MD5

      3c658c1945c067468d8f79db07643e90

    • SHA1

      84510320b162e4023406d928f0a301e082ef4269

    • SHA256

      79fd71ef4c7fbc43cf914ec82d00056f9e3b8812e2589717f265f3c7623f2606

    • SHA512

      d19737c15fb5bcd2187cf3bbc7fe6ea65bdf4bfacb16c00b86862e3124484c450a1e54fcdf5b9a454187bb2133b27a7e43c8e49a516b327b10fc863d400632d6

    • SSDEEP

      1536:bNOLSWhnirjfpNGLsmYTQssZiFFvVQwoQy0+47XvcW2svXlrtkt99933Jn:5Ox2jxYYnQ5OCwooUsv94J

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Drops file in Drivers directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks