Overview

overview

10

Static

static

Докум...19.exe

windows7_x64

10

Докум...19.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04710be5ee1f33f7e6e752588ed57894f48e62e2f9161f1385ebcfd65987920e

  • Size

    154KB

  • Sample

    220521-nfqq4sggdq

  • MD5

    d8ab78fca33634c61ab035dd961d839a

  • SHA1

    b544a35a3101046749c8e5b5ba62592d36ae09ef

  • SHA256

    04710be5ee1f33f7e6e752588ed57894f48e62e2f9161f1385ebcfd65987920e

  • SHA512

    7ed87bd458e9c007326d4245487bc3363a262262fc00be22c9ddfe58ec7e5453492d948a0412acc4aacb1b2d053b9df73337d374a170b2e3c603afc3f627557a

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Targets

    • Target

      Документы 29.07.2019.exe

    • Size

      196KB

    • MD5

      f2403ac020b62308e185b8aabc9006ae

    • SHA1

      bfcfc605155649aa6458f64017b9305888a8264f

    • SHA256

      bf5d3d55d30106e2d6c520eb7d43727f98c7e438257650908e7434ed99c590bb

    • SHA512

      392db48c2c418533ab2989e38a1c9f0b3b9a7898c9f29f014dd2120eedaa6f21259ff96615fc4d246e76ed315d514a7e59c1d5385dea59a58889b25b7511396d

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks