General

  • Target

    aa48fa678a65a000fd139edb33f46565.exe

  • Size

    103KB

  • Sample

    230713-gm2cvsfd97

  • MD5

    aa48fa678a65a000fd139edb33f46565

  • SHA1

    77463eebb9fefc63af183480d87b4742ac1d28fe

  • SHA256

    3497ec8d3717bf385a651855082d4a93805296abc5189a0a81bf51cd80d46d1e

  • SHA512

    ad7d4f0c0a13f11af35a5f80d7af220084276bf2285ffa398659fd8fbbfe51ecbbff54e14b6a88da8af8ab3769de9e68b2fed5d8b5bef224d630faa872c8bcaf

  • SSDEEP

    1536:vt8UEN3YqiqTLEcW+L9gs2rS+TTYz52kqnjQXyAOrc6neTvDkzbklql/2fqh:Ch1H1W9+eNkdOrDnH0ql/2fqh

Malware Config

Extracted

Family

pony

C2

http://top.thisispw.com/keys7369921/gate.php

Targets

    • Target

      aa48fa678a65a000fd139edb33f46565.exe

    • Size

      103KB

    • MD5

      aa48fa678a65a000fd139edb33f46565

    • SHA1

      77463eebb9fefc63af183480d87b4742ac1d28fe

    • SHA256

      3497ec8d3717bf385a651855082d4a93805296abc5189a0a81bf51cd80d46d1e

    • SHA512

      ad7d4f0c0a13f11af35a5f80d7af220084276bf2285ffa398659fd8fbbfe51ecbbff54e14b6a88da8af8ab3769de9e68b2fed5d8b5bef224d630faa872c8bcaf

    • SSDEEP

      1536:vt8UEN3YqiqTLEcW+L9gs2rS+TTYz52kqnjQXyAOrc6neTvDkzbklql/2fqh:Ch1H1W9+eNkdOrDnH0ql/2fqh

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Tasks