General

  • Target

    32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56

  • Size

    116KB

  • Sample

    221127-rq8lfshd2z

  • MD5

    182ecde7cce330542e2d662e5e7b2e1c

  • SHA1

    cace25d3440230aec03adebf832ac428f780e5b6

  • SHA256

    32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56

  • SHA512

    17c1b288a23fc87f60119d3b36a27114edfe031fed6dc604a01d1d7206fd49382a32a0a84146ae59e8b6e652a1622a06ec141ad0439639b58634892ae5494618

  • SSDEEP

    3072:RxZC5IJc19PKDg2mLXSBMOVex056lMu1+xkMu1+:1QJuQmBnClMu1+iMu1+

Malware Config

Extracted

Family

pony

C2

http://transoceanoll.com/bl/gate.php

Targets

    • Target

      32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56

    • Size

      116KB

    • MD5

      182ecde7cce330542e2d662e5e7b2e1c

    • SHA1

      cace25d3440230aec03adebf832ac428f780e5b6

    • SHA256

      32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56

    • SHA512

      17c1b288a23fc87f60119d3b36a27114edfe031fed6dc604a01d1d7206fd49382a32a0a84146ae59e8b6e652a1622a06ec141ad0439639b58634892ae5494618

    • SSDEEP

      3072:RxZC5IJc19PKDg2mLXSBMOVex056lMu1+xkMu1+:1QJuQmBnClMu1+iMu1+

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks