General

  • Target

    10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585

  • Size

    78KB

  • Sample

    221120-lesg7sba5z

  • MD5

    57d3a2f9d8a911eedc5d7a833782e55c

  • SHA1

    5752469dcf41fe0cf9b4a96f5608c8b40f4a52a4

  • SHA256

    10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585

  • SHA512

    db3e489fbd69c4f1358418b617124e231b4af50bb4c003153422a48bc53bfec81589079710efb1ba0ad842d2f8d5adb0b45d74d2b05006f7c697928612f86043

  • SSDEEP

    1536:e7I44meDR3VAwilSc6bm+8+k0FRpZ5V2ektonrUYvjJ:CL4meDR3m/lS1CKRpZfkt2rX1

Malware Config

Extracted

Family

pony

C2

http://googleapis.com/gate.php

http://web-cdn-node.com/gate.php

http://fbstatic-a.akamaihd.net/gate.php

http://l.yimg.com/gate.php

http://simple-cdn-node.com/gate.php

http://nym1.ib.adnxs.com/gate.php

http://cloud13.browser.ovi.com/gate.php

http://web-cdn-node.com/1.exe?c=1

Attributes
  • payload_url

    http://web-cdn-node.com/6.exe

Targets

    • Target

      10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585

    • Size

      78KB

    • MD5

      57d3a2f9d8a911eedc5d7a833782e55c

    • SHA1

      5752469dcf41fe0cf9b4a96f5608c8b40f4a52a4

    • SHA256

      10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585

    • SHA512

      db3e489fbd69c4f1358418b617124e231b4af50bb4c003153422a48bc53bfec81589079710efb1ba0ad842d2f8d5adb0b45d74d2b05006f7c697928612f86043

    • SSDEEP

      1536:e7I44meDR3VAwilSc6bm+8+k0FRpZ5V2ektonrUYvjJ:CL4meDR3m/lS1CKRpZfkt2rX1

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks