General

  • Target

    qxHaVt5PjLDB5hS.exe

  • Size

    211KB

  • Sample

    201109-lv2e548zan

  • MD5

    85e5d033dd4d58642fcfd8894405191e

  • SHA1

    60bbf4133bb8897f6130fcc37bbf9c71139f0fba

  • SHA256

    f4e44a53a69291a3e254cc11fcf4dbe244f407cff4d919526a2532c65654ad89

  • SHA512

    e3a00949d90c165d0cc6608f5de1a75d37d4ea4f7772e5253714e4827b7e59fca0d657a886bd997b3132f81bb03017e975b8c7117088ae57131327bf09d85d31

Malware Config

Targets

    • Target

      qxHaVt5PjLDB5hS.exe

    • Size

      211KB

    • MD5

      85e5d033dd4d58642fcfd8894405191e

    • SHA1

      60bbf4133bb8897f6130fcc37bbf9c71139f0fba

    • SHA256

      f4e44a53a69291a3e254cc11fcf4dbe244f407cff4d919526a2532c65654ad89

    • SHA512

      e3a00949d90c165d0cc6608f5de1a75d37d4ea4f7772e5253714e4827b7e59fca0d657a886bd997b3132f81bb03017e975b8c7117088ae57131327bf09d85d31

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks