General

  • Target

    237090a05b54e8dc99189b427567c560cc9d27a353b713d181716217adfa522c

  • Size

    34KB

  • Sample

    221125-z43lcsaf21

  • MD5

    76c18a5519236a6c48aa53f495ec7ad7

  • SHA1

    438fb0b398aca22cd3928feef9d487e8e9de7b8c

  • SHA256

    237090a05b54e8dc99189b427567c560cc9d27a353b713d181716217adfa522c

  • SHA512

    637cd3f35e9c35e10babcb78b3f0d1490fd5804529ba6931f9227bc27ac824cfed0c2b289d52bd3628751862b0dee356737165c2c305fb54046274094dc07f46

  • SSDEEP

    384:a2ZR3eABDzy93AWZgqnOs5D6XdpreAWWYb19+xu9bHSlMijBNcj//31yLrr+PPbx:f73bla93t8G4Y/bNHSlxXcpM3+7nMU

Malware Config

Extracted

Family

pony

C2

http://192.163.227.127/it/gate.php

http://starcentres.com/logo14673.gif

Targets

    • Target

      237090a05b54e8dc99189b427567c560cc9d27a353b713d181716217adfa522c

    • Size

      34KB

    • MD5

      76c18a5519236a6c48aa53f495ec7ad7

    • SHA1

      438fb0b398aca22cd3928feef9d487e8e9de7b8c

    • SHA256

      237090a05b54e8dc99189b427567c560cc9d27a353b713d181716217adfa522c

    • SHA512

      637cd3f35e9c35e10babcb78b3f0d1490fd5804529ba6931f9227bc27ac824cfed0c2b289d52bd3628751862b0dee356737165c2c305fb54046274094dc07f46

    • SSDEEP

      384:a2ZR3eABDzy93AWZgqnOs5D6XdpreAWWYb19+xu9bHSlMijBNcj//31yLrr+PPbx:f73bla93t8G4Y/bNHSlxXcpM3+7nMU

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks