General

  • Target

    16692ab38663ca618f3c522177c8732abe93fe4377b498940579d829eee65027

  • Size

    476KB

  • Sample

    220521-m5gztsgbel

  • MD5

    57f2ba065b0ce36fae72e7851cf41710

  • SHA1

    9b24445da82bea5e1593a2216faab6f4f6d5fee5

  • SHA256

    16692ab38663ca618f3c522177c8732abe93fe4377b498940579d829eee65027

  • SHA512

    d9d14c944881c5c5fe434093f170821c83654aebd086b45ffe8cbd0b37dd0f1a2ccf1ad95c9de8dc52b148be7c2fa15516caf76f911d74229c7c8bdf7af87379

Malware Config

Targets

    • Target

      QWA.exe

    • Size

      879KB

    • MD5

      bd1c429c2ea9b2c200470e0859761692

    • SHA1

      4cbddc4bb7db82fbb0c7781d0e07ad1b0279e8af

    • SHA256

      f711673ec31f884e59192cc360b841efc1c77b0d0b41787bea5424ae520f9989

    • SHA512

      605730afdf0e9f381abfcf5bf17ad39538c8ed395ecb2edaa4369e7302dbde1282116dd1b40e617ca152e15ab445951032145b1f06292807023358acc91dbf18

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks