General
- Target afa7c6348ac900eaefe5053f9c95988c930a367653e8ca4aeed5db6ff5cd49a1
- Size 808KB
- Sample221107-ysyycsfdf5
- SHA256 afa7c6348ac900eaefe5053f9c95988c930a367653e8ca4aeed5db6ff5cd49a1
Score
10/10
Malware Config
Targets
-
- Target afa7c6348ac900eaefe5053f9c95988c930a367653e8ca4aeed5db6ff5cd49a1
- Size 808KB
- SHA256 afa7c6348ac900eaefe5053f9c95988c930a367653e8ca4aeed5db6ff5cd49a1
Score10/10Modifies WinLogon for persistence
Modifies security service
Modifies visiblity of hidden/system files in Explorer
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
Disables taskbar notifications via registry modification
Executes dropped EXE
Modifies Installed Components in the registry
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of SetThreadContext