General

  • Target

    3b10c37fcd1e6f1d4a05c8eb5a504eebc6d9d24e7c86162ed22e7e99e0194116

  • Size

    596KB

  • Sample

    221126-g47k7sca9z

  • MD5

    a695eff1bd4db157ed9cb110e73d2458

  • SHA1

    ad0cf332a3ccb73d7c6eb541c9eda98b77a0acfa

  • SHA256

    3b10c37fcd1e6f1d4a05c8eb5a504eebc6d9d24e7c86162ed22e7e99e0194116

  • SHA512

    140507fab257ce37a37718f9eefe8b237f4179ee06ddc2bdd072fe2c8e5f8d011f385cfbd2e21fc1f6bd4d21e02db621f4d03c631e5186d1b7e6cc0326bc6cc7

  • SSDEEP

    6144:d/dXwHf6Go1Lz5jlMaGYq9SJYJf6icbjBSpRoDomlZDd0+MhoMnX+GGjGGtGGxG2:/wyGoV5jlMeYACojFMuMnXPMGh

Malware Config

Extracted

Family

pony

C2

http://www.creativehands.org.np/wp-admin/netw/new/gate.php

Attributes
  • payload_url

    http://www.creativehands.org.np/wp-admin/netw/new/micro.exe

Targets

    • Target

      3b10c37fcd1e6f1d4a05c8eb5a504eebc6d9d24e7c86162ed22e7e99e0194116

    • Size

      596KB

    • MD5

      a695eff1bd4db157ed9cb110e73d2458

    • SHA1

      ad0cf332a3ccb73d7c6eb541c9eda98b77a0acfa

    • SHA256

      3b10c37fcd1e6f1d4a05c8eb5a504eebc6d9d24e7c86162ed22e7e99e0194116

    • SHA512

      140507fab257ce37a37718f9eefe8b237f4179ee06ddc2bdd072fe2c8e5f8d011f385cfbd2e21fc1f6bd4d21e02db621f4d03c631e5186d1b7e6cc0326bc6cc7

    • SSDEEP

      6144:d/dXwHf6Go1Lz5jlMaGYq9SJYJf6icbjBSpRoDomlZDd0+MhoMnX+GGjGGtGGxG2:/wyGoV5jlMeYACojFMuMnXPMGh

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks