General

  • Target

    c59af2ee272506bca1bc74970cb777553b1923aaf2f210e411f6933a41ef0d35.exe

  • Size

    161KB

  • Sample

    210227-ckgzzp3qe6

  • MD5

    ad022eff3f11b9cecf41a6c628120c9f

  • SHA1

    b996e3c1b5b4a78ce26f54abc3af212632566e0f

  • SHA256

    c59af2ee272506bca1bc74970cb777553b1923aaf2f210e411f6933a41ef0d35

  • SHA512

    8d8974a0e78df2a9eec7aa160c3de17a15e8889f5106febbcffef1c447133c7645024f3aac0e0d94c2feed525f0bb87cf385add51957a16b7f175519e3b9c935

Malware Config

Targets

    • Target

      c59af2ee272506bca1bc74970cb777553b1923aaf2f210e411f6933a41ef0d35.exe

    • Size

      161KB

    • MD5

      ad022eff3f11b9cecf41a6c628120c9f

    • SHA1

      b996e3c1b5b4a78ce26f54abc3af212632566e0f

    • SHA256

      c59af2ee272506bca1bc74970cb777553b1923aaf2f210e411f6933a41ef0d35

    • SHA512

      8d8974a0e78df2a9eec7aa160c3de17a15e8889f5106febbcffef1c447133c7645024f3aac0e0d94c2feed525f0bb87cf385add51957a16b7f175519e3b9c935

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks