General

  • Target

    757a1b22ced9d7e3de0ece434e89a9f65e3f2037781ac523a05ba994c444db8fN

  • Size

    147KB

  • Sample

    241018-p8ckma1akj

  • MD5

    39ae2b0d9c6fd7f8f27547f1be7f0ea0

  • SHA1

    a4b90a0844262eb9e6b813c515767f0ca560b8c0

  • SHA256

    757a1b22ced9d7e3de0ece434e89a9f65e3f2037781ac523a05ba994c444db8f

  • SHA512

    c2f1be71e1f46629214e7f9f9e0691efc1923e74b6707c55bce5b843953e4c70182b76e06cecb88555a1b6d657ea7b74ece25f6766214afab46e4a2b9174f673

  • SSDEEP

    3072:aviHHDx8aasGanPWoc+VZLXk3Yxnya7iWbavysLbncf1fMlBgpm/PTNo9:oiHF1PnucZLMYhsLbnc9yja

Malware Config

Extracted

Family

pony

C2

http://178.32.160.255:8080/ponychin/gate.php

http://91.121.178.156:8080/ponychin/gate.php

Targets

    • Target

      757a1b22ced9d7e3de0ece434e89a9f65e3f2037781ac523a05ba994c444db8fN

    • Size

      147KB

    • MD5

      39ae2b0d9c6fd7f8f27547f1be7f0ea0

    • SHA1

      a4b90a0844262eb9e6b813c515767f0ca560b8c0

    • SHA256

      757a1b22ced9d7e3de0ece434e89a9f65e3f2037781ac523a05ba994c444db8f

    • SHA512

      c2f1be71e1f46629214e7f9f9e0691efc1923e74b6707c55bce5b843953e4c70182b76e06cecb88555a1b6d657ea7b74ece25f6766214afab46e4a2b9174f673

    • SSDEEP

      3072:aviHHDx8aasGanPWoc+VZLXk3Yxnya7iWbavysLbncf1fMlBgpm/PTNo9:oiHF1PnucZLMYhsLbnc9yja

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks