General

  • Target

    5908ee35ba3fd88b7ffbc657655d51fc2a4be65198c8dfb7034ab2c4b15ea60c

  • Size

    84KB

  • Sample

    221126-kbp28sef96

  • MD5

    bf5256a9a0cd4542cac9d4334628ebea

  • SHA1

    a5ef591fc68dfbc6787c31dd030c55c82d67902e

  • SHA256

    5908ee35ba3fd88b7ffbc657655d51fc2a4be65198c8dfb7034ab2c4b15ea60c

  • SHA512

    dcd81038eac1d300483df81555178f8e92e83cd1ece9a262e7b02609d2682f1ba60b9996b8ec66b6b945d03756190b678064b949f0037790b84214a7afa7598a

  • SSDEEP

    1536:IByI/qNTqFeUVk19k3yhI9isTY8JvqMIruYZ7iR3cu/OY6LCtR:GyIiTJ/ZuYMTs7u/OYQYR

Malware Config

Extracted

Family

pony

C2

http://sweetstrass.com/css/pony/Panel/gate.php

Attributes
  • payload_url

    http://sweetstrass.com/css/pony/Panel/Purchase Order.exe

Targets

    • Target

      5908ee35ba3fd88b7ffbc657655d51fc2a4be65198c8dfb7034ab2c4b15ea60c

    • Size

      84KB

    • MD5

      bf5256a9a0cd4542cac9d4334628ebea

    • SHA1

      a5ef591fc68dfbc6787c31dd030c55c82d67902e

    • SHA256

      5908ee35ba3fd88b7ffbc657655d51fc2a4be65198c8dfb7034ab2c4b15ea60c

    • SHA512

      dcd81038eac1d300483df81555178f8e92e83cd1ece9a262e7b02609d2682f1ba60b9996b8ec66b6b945d03756190b678064b949f0037790b84214a7afa7598a

    • SSDEEP

      1536:IByI/qNTqFeUVk19k3yhI9isTY8JvqMIruYZ7iR3cu/OY6LCtR:GyIiTJ/ZuYMTs7u/OYQYR

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks