General

  • Target

    bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91

  • Size

    114KB

  • Sample

    221203-g5hngabg86

  • MD5

    68d98b222464c208b28627041cb04062

  • SHA1

    a330c5e4e628a2cf329d82badc90528404a02556

  • SHA256

    bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91

  • SHA512

    038c1e95bbf524b852d02a5c32bdd46db6d6c1263bb2af587a0949c06cc4c43a15c91e2e8c10b5a46ff33a0eb14054ec8abbe6be400a18c373f3f53504f05537

  • SSDEEP

    3072:hRHZWQgYjUJapCJhR9EoD9wZ9QX8nhhBQuQ:bZ5g4UJCOhUoZw7QufQ

Malware Config

Extracted

Family

pony

C2

http://trueyogateacherblog.com/resp.php

http://thesavvyplayer.com/images/view.php

Targets

    • Target

      bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91

    • Size

      114KB

    • MD5

      68d98b222464c208b28627041cb04062

    • SHA1

      a330c5e4e628a2cf329d82badc90528404a02556

    • SHA256

      bb304285866d6484534485e20c9dc455843a7745d0685ee6688780c78fc56e91

    • SHA512

      038c1e95bbf524b852d02a5c32bdd46db6d6c1263bb2af587a0949c06cc4c43a15c91e2e8c10b5a46ff33a0eb14054ec8abbe6be400a18c373f3f53504f05537

    • SSDEEP

      3072:hRHZWQgYjUJapCJhR9EoD9wZ9QX8nhhBQuQ:bZ5g4UJCOhUoZw7QufQ

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks