General

  • Target

    8c4867a9eb8c945370a142fff1916a441d56435e3a122cd913600339f05b73f9

  • Size

    335KB

  • Sample

    221127-m4tl8sca39

  • MD5

    4f70d7a830cc54b43b3c6290de2bd6d4

  • SHA1

    545ca923d8137a88aa2e48d35385011457085f23

  • SHA256

    8c4867a9eb8c945370a142fff1916a441d56435e3a122cd913600339f05b73f9

  • SHA512

    98f84b18fba58432b845d46c6a3e8a86f7e437cbf167c54792b8a1d6ef57881af05fef586560932369a27803b800cc47bffe691e76ac02cf5088151c754563b0

  • SSDEEP

    6144:fGb+AuERIfTTI/J/mS+S63bfU+JPXjQt5I4bSyG4hvi+jGaVtl/YU49hWHIP3nBO:9bEW3uPGfUkzQsaSZ4h349h4IP3B

Malware Config

Extracted

Family

pony

C2

http://timmicool.funpic.de/michu/mange/images/gate.php

Targets

    • Target

      8c4867a9eb8c945370a142fff1916a441d56435e3a122cd913600339f05b73f9

    • Size

      335KB

    • MD5

      4f70d7a830cc54b43b3c6290de2bd6d4

    • SHA1

      545ca923d8137a88aa2e48d35385011457085f23

    • SHA256

      8c4867a9eb8c945370a142fff1916a441d56435e3a122cd913600339f05b73f9

    • SHA512

      98f84b18fba58432b845d46c6a3e8a86f7e437cbf167c54792b8a1d6ef57881af05fef586560932369a27803b800cc47bffe691e76ac02cf5088151c754563b0

    • SSDEEP

      6144:fGb+AuERIfTTI/J/mS+S63bfU+JPXjQt5I4bSyG4hvi+jGaVtl/YU49hWHIP3nBO:9bEW3uPGfUkzQsaSZ4h349h4IP3B

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks