General

  • Target

    d96cc84761813a7778fd6447f672776f7321cce321950b5de58e8a45ef0589a4

  • Size

    146KB

  • Sample

    221125-z5gqaaaf5t

  • MD5

    dc3d90bb3f23edf6948016dec399f1d1

  • SHA1

    96bbb9ce9e72130f6ec0730e9d8e65aff972d52d

  • SHA256

    d96cc84761813a7778fd6447f672776f7321cce321950b5de58e8a45ef0589a4

  • SHA512

    9ad9ef8923fd5291d0361e2d02c90916eb1a4d9695d79beb060a24d8e8d43203ed419f127d6246c7828f57883315c3d1db1c1f501023aca584beaa1b75edf6f1

  • SSDEEP

    3072:nwQMZvj7qcpjE2mbHie0viBKGRyrfgFW+pl9Jwb2yax5QqrmMxPFKXzGm8S5Q+:ij7qchEXdwazJJyax5QqSMxPFKXv5Q+

Malware Config

Extracted

Family

pony

C2

http://abalinaa.in/Panel/gate.php

Attributes
  • payload_url

    http://abalinaa.in/Panel/micro.exe

Targets

    • Target

      d96cc84761813a7778fd6447f672776f7321cce321950b5de58e8a45ef0589a4

    • Size

      146KB

    • MD5

      dc3d90bb3f23edf6948016dec399f1d1

    • SHA1

      96bbb9ce9e72130f6ec0730e9d8e65aff972d52d

    • SHA256

      d96cc84761813a7778fd6447f672776f7321cce321950b5de58e8a45ef0589a4

    • SHA512

      9ad9ef8923fd5291d0361e2d02c90916eb1a4d9695d79beb060a24d8e8d43203ed419f127d6246c7828f57883315c3d1db1c1f501023aca584beaa1b75edf6f1

    • SSDEEP

      3072:nwQMZvj7qcpjE2mbHie0viBKGRyrfgFW+pl9Jwb2yax5QqrmMxPFKXzGm8S5Q+:ij7qchEXdwazJJyax5QqSMxPFKXv5Q+

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks