General

  • Target

    50fa26e1b903d4742b2837a99c773d0bab46b7f715bc6fcd78515253fbc4c201

  • Size

    280KB

  • Sample

    221119-vfwqpafb4t

  • MD5

    40d3906ffc1136b1da17e0d95ada76e5

  • SHA1

    04e5095f2950796894245df954005db5cb2cf034

  • SHA256

    50fa26e1b903d4742b2837a99c773d0bab46b7f715bc6fcd78515253fbc4c201

  • SHA512

    a1fd707f3a0270ec63187ad4ff8b3ad3ca53d187072784e7db4249fce15199e420aca3d7cf733aab81ae5af606b8357817663f395a34d74eb42430571bc42885

  • SSDEEP

    6144:lfj5MuAKpvI2ao/AJhwXzCP9UO/hvl9GYQ6MtxEpXVL8:lfXfIlwX+UI/Q6MtG8

Malware Config

Targets

    • Target

      50fa26e1b903d4742b2837a99c773d0bab46b7f715bc6fcd78515253fbc4c201

    • Size

      280KB

    • MD5

      40d3906ffc1136b1da17e0d95ada76e5

    • SHA1

      04e5095f2950796894245df954005db5cb2cf034

    • SHA256

      50fa26e1b903d4742b2837a99c773d0bab46b7f715bc6fcd78515253fbc4c201

    • SHA512

      a1fd707f3a0270ec63187ad4ff8b3ad3ca53d187072784e7db4249fce15199e420aca3d7cf733aab81ae5af606b8357817663f395a34d74eb42430571bc42885

    • SSDEEP

      6144:lfj5MuAKpvI2ao/AJhwXzCP9UO/hvl9GYQ6MtxEpXVL8:lfXfIlwX+UI/Q6MtG8

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks