General

  • Target

    Invoice AWB00015564.exe

  • Size

    743KB

  • Sample

    201027-6lnx5xwh26

  • MD5

    9ab53021910d341db01247be219738dd

  • SHA1

    45c9b363f480a24db575a0b8656efa929b905cd4

  • SHA256

    9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377

  • SHA512

    30a11381d4d87f1e15ebf5c0feb0a830b3ec0de9f4f85d31aacf42e0777a1fa0306f7cae093d17bbefb4bd984e409fae019ec6eed737556bc1336e34953e0e1e

Malware Config

Targets

    • Target

      Invoice AWB00015564.exe

    • Size

      743KB

    • MD5

      9ab53021910d341db01247be219738dd

    • SHA1

      45c9b363f480a24db575a0b8656efa929b905cd4

    • SHA256

      9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377

    • SHA512

      30a11381d4d87f1e15ebf5c0feb0a830b3ec0de9f4f85d31aacf42e0777a1fa0306f7cae093d17bbefb4bd984e409fae019ec6eed737556bc1336e34953e0e1e

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks