General

  • Target

    b20918ebebf9c662c9d8557366413d0039fed96f6080cb247a6defb6cf100f63

  • Size

    112KB

  • Sample

    221203-hz3l5ahg3s

  • MD5

    2846be5cace52ef6f39096afb946faf0

  • SHA1

    92b4b70ef6548412d6393856135558f1e1a594b2

  • SHA256

    b20918ebebf9c662c9d8557366413d0039fed96f6080cb247a6defb6cf100f63

  • SHA512

    05d6bde9cb49f1ef88fd64904618b39c46d0d77250a999e204511125f59d66114e322b1b0c77f74c0a7b7495f8e7216b93b53c75d28bc9b956fb5ccf165dbda0

  • SSDEEP

    3072:/L5C00+vwVeCxLiU8q/RJDbo2kFt2qi5WFUKw9fR:I00nA0iU8q/zdwqEUK2

Malware Config

Extracted

Family

pony

C2

http://kitchenwalla.com/forum/viewtopic.php

http://london-leather.com/forum/viewtopic.php

http://londonleatheronline.com/forum/viewtopic.php

http://londonleatherusa.com/forum/viewtopic.php

Attributes
  • payload_url

    http://lottieandjakes.co.uk/5AC4Pz.exe

    http://residenceartigny.be/1eoqj.exe

    http://hc-oneprint.co.uk/QEM0.exe

Targets

    • Target

      b20918ebebf9c662c9d8557366413d0039fed96f6080cb247a6defb6cf100f63

    • Size

      112KB

    • MD5

      2846be5cace52ef6f39096afb946faf0

    • SHA1

      92b4b70ef6548412d6393856135558f1e1a594b2

    • SHA256

      b20918ebebf9c662c9d8557366413d0039fed96f6080cb247a6defb6cf100f63

    • SHA512

      05d6bde9cb49f1ef88fd64904618b39c46d0d77250a999e204511125f59d66114e322b1b0c77f74c0a7b7495f8e7216b93b53c75d28bc9b956fb5ccf165dbda0

    • SSDEEP

      3072:/L5C00+vwVeCxLiU8q/RJDbo2kFt2qi5WFUKw9fR:I00nA0iU8q/zdwqEUK2

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks