General

  • Target

    3508c14355057b9c4dc656411a45726af7b9efef930640553a4223863e0cbca7

  • Size

    198KB

  • Sample

    221001-zb49gseea6

  • MD5

    6530690c5735535289a9c72ce28d4faa

  • SHA1

    bf30348a4bda3f033fb5e3de9509830002bfacba

  • SHA256

    3508c14355057b9c4dc656411a45726af7b9efef930640553a4223863e0cbca7

  • SHA512

    94064b42207e3ca69677beb5b5b02608e601bb8b6e98d0cd3b7d780c1244f175d30b015142ceded1d2520d00adf352141f715fa41d0ae8164bab6391af086823

  • SSDEEP

    1536:XVISYx82lPOiyQd6Gg/WfzVung7AnkPiK3RWjZh3ZAQ6Pxn2UmDtvJkxYPcciQrE:lh4PORkvg/454KBWP3SQ6TqtvJtEcRyH

Malware Config

Targets

    • Target

      3508c14355057b9c4dc656411a45726af7b9efef930640553a4223863e0cbca7

    • Size

      198KB

    • MD5

      6530690c5735535289a9c72ce28d4faa

    • SHA1

      bf30348a4bda3f033fb5e3de9509830002bfacba

    • SHA256

      3508c14355057b9c4dc656411a45726af7b9efef930640553a4223863e0cbca7

    • SHA512

      94064b42207e3ca69677beb5b5b02608e601bb8b6e98d0cd3b7d780c1244f175d30b015142ceded1d2520d00adf352141f715fa41d0ae8164bab6391af086823

    • SSDEEP

      1536:XVISYx82lPOiyQd6Gg/WfzVung7AnkPiK3RWjZh3ZAQ6Pxn2UmDtvJkxYPcciQrE:lh4PORkvg/454KBWP3SQ6TqtvJtEcRyH

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks