General
- Target Signed_POno20200625.doc
- Size 114KB
- Sample200625-6dfewmgth2
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
Score
10/10
Malware Config
Targets
-
- Target Signed_POno20200625.doc
- Size 114KB
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
Score10/10Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Blacklisted process makes network request
Executes dropped EXE
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Use of msiexec (install) with remote resource
Checks for installed software on the system
Enumerates connected drives
Suspicious use of SetThreadContext