General

  • Target

    10013b1953c2570f66c1c866343db9e8.exe

  • Size

    100KB

  • Sample

    221204-qph4qsgc91

  • MD5

    10013b1953c2570f66c1c866343db9e8

  • SHA1

    16c1fcb19161e7ec1a976f445927c322e0b5eed3

  • SHA256

    452cbd43da0897265fd82730973574f94dcc2be7cd8d8606fa992f609d9be39e

  • SHA512

    04bd8859e1711c972fe02f25e7a78cf852deacbba7a0de86867b68ea904dce102713efcf2e21600b04506ccfc2ad606adb9d1275a8da99cfd031fc749a3164cb

  • SSDEEP

    1536:WcEY/ws9qTT72dtvsS9siS4AIkESMNQ+C3mDXx5mO4SpytMTvHEKCkzm4c:vEzKtpAIZNQbOUQEKa1

Malware Config

Extracted

Family

pony

C2

http://patatespique.com/base/panelnew/gate.php

Targets

    • Target

      10013b1953c2570f66c1c866343db9e8.exe

    • Size

      100KB

    • MD5

      10013b1953c2570f66c1c866343db9e8

    • SHA1

      16c1fcb19161e7ec1a976f445927c322e0b5eed3

    • SHA256

      452cbd43da0897265fd82730973574f94dcc2be7cd8d8606fa992f609d9be39e

    • SHA512

      04bd8859e1711c972fe02f25e7a78cf852deacbba7a0de86867b68ea904dce102713efcf2e21600b04506ccfc2ad606adb9d1275a8da99cfd031fc749a3164cb

    • SSDEEP

      1536:WcEY/ws9qTT72dtvsS9siS4AIkESMNQ+C3mDXx5mO4SpytMTvHEKCkzm4c:vEzKtpAIZNQbOUQEKa1

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks