General

  • Target

    ce44bd653dd9ad0367bb7769ec983e892eb6c69a6ce0579ca516d45b62d51348

  • Size

    34KB

  • Sample

    221125-z4z58saf2y

  • MD5

    8a54455de3cbaaee3db2addc486af9a9

  • SHA1

    ed156d39320803c172923c53e4b939ebdbbf119a

  • SHA256

    ce44bd653dd9ad0367bb7769ec983e892eb6c69a6ce0579ca516d45b62d51348

  • SHA512

    c2542a397627043f6974477819ac1cd81aee484399bb1ea44653b3f113a31cdd6416e6f0c5fe5638c67e8c61e776a52cd60d80f6322b55ed7edf0fd7ddcdf84b

  • SSDEEP

    768:+BAqAd12iWZNgT46haGMMbS7hZ4tDXx9:+BAqikiEOT46h6MbkhZ4tDB9

Malware Config

Extracted

Family

pony

C2

http://hylt168.com/cgi/logo/gate.php

Attributes
  • payload_url

    http://hylt168.com/cgi/logo/Pony.exe

Targets

    • Target

      ce44bd653dd9ad0367bb7769ec983e892eb6c69a6ce0579ca516d45b62d51348

    • Size

      34KB

    • MD5

      8a54455de3cbaaee3db2addc486af9a9

    • SHA1

      ed156d39320803c172923c53e4b939ebdbbf119a

    • SHA256

      ce44bd653dd9ad0367bb7769ec983e892eb6c69a6ce0579ca516d45b62d51348

    • SHA512

      c2542a397627043f6974477819ac1cd81aee484399bb1ea44653b3f113a31cdd6416e6f0c5fe5638c67e8c61e776a52cd60d80f6322b55ed7edf0fd7ddcdf84b

    • SSDEEP

      768:+BAqAd12iWZNgT46haGMMbS7hZ4tDXx9:+BAqikiEOT46h6MbkhZ4tDB9

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks