General

  • Target

    3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a

  • Size

    175KB

  • Sample

    221011-jxxhrsdbg6

  • MD5

    7d3ee4653a1ac1339911204351b802c8

  • SHA1

    636b2a204836ae6e607bad2fbea2b5933d47cce7

  • SHA256

    3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a

  • SHA512

    09f130bd848b5e7bd3c24ca68e1d9ee3e428f95ab77275a2f2044f7aa916734283d65b119f3e93f07895615f8853f6ea65d73c6c1dfac98f1317f7a2a17c1d91

  • SSDEEP

    3072:BKdg+BnVxOGLTBgUv45NWpWfcZZzZZBZZOZZHl4A:B+giO8TBgbNoWfcnznBnOnF7

Malware Config

Targets

    • Target

      3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a

    • Size

      175KB

    • MD5

      7d3ee4653a1ac1339911204351b802c8

    • SHA1

      636b2a204836ae6e607bad2fbea2b5933d47cce7

    • SHA256

      3425d35751c5ead9b311eaa0e04a211365a55827058e7e65c94f9a5a47edf26a

    • SHA512

      09f130bd848b5e7bd3c24ca68e1d9ee3e428f95ab77275a2f2044f7aa916734283d65b119f3e93f07895615f8853f6ea65d73c6c1dfac98f1317f7a2a17c1d91

    • SSDEEP

      3072:BKdg+BnVxOGLTBgUv45NWpWfcZZzZZBZZOZZHl4A:B+giO8TBgbNoWfcnznBnOnF7

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks