General

  • Target

    e227be993c9e58797b6189c652a585fb

  • Size

    148KB

  • Sample

    240327-vhl92age49

  • MD5

    e227be993c9e58797b6189c652a585fb

  • SHA1

    414475bbfc35e037b64e0811ee8e7d674e32b737

  • SHA256

    24ee912caf5e4e0cebaac0f0f5422626b7859be66f1e1afca59a9e34564e5e48

  • SHA512

    f73c43194ebafae44bb253b25bf47f38cd41cdbda5263e3580287e53103d0d0c3254159871ca1c2129ab290a2231e5c4f2bc36055ea763375d647e18f0c8859b

  • SSDEEP

    1536:InpLaJGl7XX/j31w7NODnsqXffSyq+Vjz/+OxvpweD7SfldeNxqdaNBzFaDC2cTB:dJGlzPjlw7Nyfw+h/txBfWS5FapcU3M

Malware Config

Extracted

Family

pony

C2

http://bullonthewall.com/forum/viewtopic.php

http://rodeostriker.com/forum/viewtopic.php

Attributes
  • payload_url

    http://degereedschapzaak.nl/S3EAwAc5.exe

    http://www.editorialtripie.com/WcF.exe

    http://www.dream-box88.de/SfLEp.exe

Targets

    • Target

      e227be993c9e58797b6189c652a585fb

    • Size

      148KB

    • MD5

      e227be993c9e58797b6189c652a585fb

    • SHA1

      414475bbfc35e037b64e0811ee8e7d674e32b737

    • SHA256

      24ee912caf5e4e0cebaac0f0f5422626b7859be66f1e1afca59a9e34564e5e48

    • SHA512

      f73c43194ebafae44bb253b25bf47f38cd41cdbda5263e3580287e53103d0d0c3254159871ca1c2129ab290a2231e5c4f2bc36055ea763375d647e18f0c8859b

    • SSDEEP

      1536:InpLaJGl7XX/j31w7NODnsqXffSyq+Vjz/+OxvpweD7SfldeNxqdaNBzFaDC2cTB:dJGlzPjlw7Nyfw+h/txBfWS5FapcU3M

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks