General

  • Target

    4C4183C8EBC475E86F0E75C7D99672EA.exe

  • Size

    90KB

  • Sample

    240526-ccph4aag4w

  • MD5

    4c4183c8ebc475e86f0e75c7d99672ea

  • SHA1

    3dd803510d69a2ac5fdc286ef4ff093eee92f08b

  • SHA256

    78d55cdf8b678679a373f1defc1062b4a9e3a23eb5fdcf0230ee032334f5ba0f

  • SHA512

    7b1ad92b67b43bf18faa3613b1385770f9898d27f8aca9cf7368a9d25bb47fd6ce112fb97a6ee1fe65e79435baf9b8a6ab419455fc72ed5ea02126a6f9e29ecd

  • SSDEEP

    1536:w68nFlZqTYyXNfnoS2t7zRKf/Sc2VTOLUUrvnYicbNOd0xTvaEiykzZXR:wRbWASKRKf/S8wUKNO3Eidh

Malware Config

Extracted

Family

pony

C2

http://72.243.190.162:8080/forum/viewtopic.php

http://198.74.55.173/forum/viewtopic.php

Attributes
  • payload_url

    http://ariane.fiducie.fr/aZUQvgm0.exe

    http://home.meischner.net/BANGf.exe

    http://mihneabelcin.com/Upq.exe

Targets

    • Target

      4C4183C8EBC475E86F0E75C7D99672EA.exe

    • Size

      90KB

    • MD5

      4c4183c8ebc475e86f0e75c7d99672ea

    • SHA1

      3dd803510d69a2ac5fdc286ef4ff093eee92f08b

    • SHA256

      78d55cdf8b678679a373f1defc1062b4a9e3a23eb5fdcf0230ee032334f5ba0f

    • SHA512

      7b1ad92b67b43bf18faa3613b1385770f9898d27f8aca9cf7368a9d25bb47fd6ce112fb97a6ee1fe65e79435baf9b8a6ab419455fc72ed5ea02126a6f9e29ecd

    • SSDEEP

      1536:w68nFlZqTYyXNfnoS2t7zRKf/Sc2VTOLUUrvnYicbNOd0xTvaEiykzZXR:wRbWASKRKf/S8wUKNO3Eidh

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks