General

  • Target

    c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014cN.exe

  • Size

    454KB

  • Sample

    241219-3far8asrct

  • MD5

    38a8e720f2ef543c92d4a619e7742e10

  • SHA1

    0dbe2b7b60cb9539edc22e115b0ce51c0037ac71

  • SHA256

    c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014c

  • SHA512

    b6e88870f530f8a54139a688b77a786b978a180a521fbcf080109b8e47eb9662e93f967539304a479677e7826826679c02573f792aec82a7aad46389fafaf644

  • SSDEEP

    6144:AXa8y9dGZueisfbReyl448dNWNXEmhuAikQJ3Q7lzuKWBzc9ewaQAuf6ba7M:maV9LpYbllJ8H+EmhuqdpWFSewaQxSb

Malware Config

Extracted

Family

pony

C2

http://usaha99.co.id/wp-admin/malmo-pony/paneltwotwo/gate.php

Attributes
  • payload_url

    http://usaha99.co.id/wp-admin/malmo-pony/paneltwotwo/shit.exe

Targets

    • Target

      c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014cN.exe

    • Size

      454KB

    • MD5

      38a8e720f2ef543c92d4a619e7742e10

    • SHA1

      0dbe2b7b60cb9539edc22e115b0ce51c0037ac71

    • SHA256

      c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014c

    • SHA512

      b6e88870f530f8a54139a688b77a786b978a180a521fbcf080109b8e47eb9662e93f967539304a479677e7826826679c02573f792aec82a7aad46389fafaf644

    • SSDEEP

      6144:AXa8y9dGZueisfbReyl448dNWNXEmhuAikQJ3Q7lzuKWBzc9ewaQAuf6ba7M:maV9LpYbllJ8H+EmhuqdpWFSewaQxSb

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.