General
- Target in_0.xls
- Size 90KB
- Sample200715-cndler9nws
- SHA256 270c390e3881b58882389e9c87b60115166a833eb2c1c5f9ad1d660a50f517a9
Score
10/10
Malware Config
Targets
-
- Target in_0.xls
- Size 90KB
- SHA256 270c390e3881b58882389e9c87b60115166a833eb2c1c5f9ad1d660a50f517a9
Score10/10Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Suspicious use of SetThreadContext