General

  • Target

    b5d5c7c414c3fe2d088d5211f8cb5d9084be73779a06885cb4ef225391965d57

  • Size

    161KB

  • Sample

    250117-hgxm6avqdz

  • MD5

    51c892662413f7a6adc25b5f5dcb9118

  • SHA1

    a73bf33493f9f4957c6e0f0609b6e1096177fcb7

  • SHA256

    b5d5c7c414c3fe2d088d5211f8cb5d9084be73779a06885cb4ef225391965d57

  • SHA512

    2a3e614b9f142b14db68232dbfb12a8aa98d1f0c52d3f43e48a5694e82276e920fd906727f2316f2066108e84c2755da528e11b6b8542d8de9ce05d74365753f

  • SSDEEP

    3072:aVN5h/bF9szqvEUgA0ChAktlFGYzWyjuiR561:aVN5hZy2vLv5lFGauyS

Malware Config

Extracted

Family

pony

C2

http://tunningdisel.com/forum/viewtopic.php

http://turbodiselvrx.com/forum/viewtopic.php

Attributes
  • payload_url

    http://3073.a.hostable.me/Z2U.exe

    http://85.18.21.252/PNV3Hbi.exe

Targets

    • Target

      b5d5c7c414c3fe2d088d5211f8cb5d9084be73779a06885cb4ef225391965d57

    • Size

      161KB

    • MD5

      51c892662413f7a6adc25b5f5dcb9118

    • SHA1

      a73bf33493f9f4957c6e0f0609b6e1096177fcb7

    • SHA256

      b5d5c7c414c3fe2d088d5211f8cb5d9084be73779a06885cb4ef225391965d57

    • SHA512

      2a3e614b9f142b14db68232dbfb12a8aa98d1f0c52d3f43e48a5694e82276e920fd906727f2316f2066108e84c2755da528e11b6b8542d8de9ce05d74365753f

    • SSDEEP

      3072:aVN5h/bF9szqvEUgA0ChAktlFGYzWyjuiR561:aVN5hZy2vLv5lFGauyS

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.