General

  • Target

    c1fcd9415d68febe7bc750815a58e03c

  • Size

    166KB

  • Sample

    201214-j5r99vmnka

  • MD5

    c1fcd9415d68febe7bc750815a58e03c

  • SHA1

    a69b5bdb67dd363243add2bec55396a574a4f091

  • SHA256

    e76c8ef328b7f2b6faf1b3d38c3c7bc13870a779b24925bd10959400a4d84575

  • SHA512

    927f57b1ff5af3b094ff5e643cfe7608d33ffa8e9d9130d3c25d0809d5c83796b35fc2afbf31e2a5f15115cd01907aedc2bd3f71a7a3433a3c5c8dd1741f771c

Malware Config

Targets

    • Target

      c1fcd9415d68febe7bc750815a58e03c

    • Size

      166KB

    • MD5

      c1fcd9415d68febe7bc750815a58e03c

    • SHA1

      a69b5bdb67dd363243add2bec55396a574a4f091

    • SHA256

      e76c8ef328b7f2b6faf1b3d38c3c7bc13870a779b24925bd10959400a4d84575

    • SHA512

      927f57b1ff5af3b094ff5e643cfe7608d33ffa8e9d9130d3c25d0809d5c83796b35fc2afbf31e2a5f15115cd01907aedc2bd3f71a7a3433a3c5c8dd1741f771c

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks