General

  • Target

    b341cdde01496a81c26e8fad238e4e501cf2a7946c51613b959767c87dc69b13

  • Size

    190KB

  • Sample

    221125-3jrj5shh3v

  • MD5

    6aefe7b28102e8d8817ab1971d01bfb7

  • SHA1

    a45bc533055975f8a24812948dde77d4f38b4a5d

  • SHA256

    b341cdde01496a81c26e8fad238e4e501cf2a7946c51613b959767c87dc69b13

  • SHA512

    4a784f825005da092e455ba3ecd55dc62486b03a590350cf83a0658e4116195fdc0bbad62a5d7f037957a993f35bdd3f94a81d96c9c5ace0190ba613f0fe82a1

  • SSDEEP

    3072:bXCtS3Ra7nhYMyon/sah+i+ZhxcZBaeoc30Z+:bXqCOtyon/saA3AXoEn

Malware Config

Targets

    • Target

      b341cdde01496a81c26e8fad238e4e501cf2a7946c51613b959767c87dc69b13

    • Size

      190KB

    • MD5

      6aefe7b28102e8d8817ab1971d01bfb7

    • SHA1

      a45bc533055975f8a24812948dde77d4f38b4a5d

    • SHA256

      b341cdde01496a81c26e8fad238e4e501cf2a7946c51613b959767c87dc69b13

    • SHA512

      4a784f825005da092e455ba3ecd55dc62486b03a590350cf83a0658e4116195fdc0bbad62a5d7f037957a993f35bdd3f94a81d96c9c5ace0190ba613f0fe82a1

    • SSDEEP

      3072:bXCtS3Ra7nhYMyon/sah+i+ZhxcZBaeoc30Z+:bXqCOtyon/saA3AXoEn

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks