General

  • Target

    a70b8c34747fbc47a18e6fac84e8aea90b7d026ee76fd224b529f5f378a90fff

  • Size

    94KB

  • Sample

    221127-m5f3jaca76

  • MD5

    99f43174691b821453fab057fbe5929f

  • SHA1

    30b6e15bb4d7ee5571bb68bd4d82baf0592a9f80

  • SHA256

    a70b8c34747fbc47a18e6fac84e8aea90b7d026ee76fd224b529f5f378a90fff

  • SHA512

    1b01d5e66a769b1287bf7b96a85a16622ed19563c76feb2904c1b6785ab166fdd821a64d60ffd939c204b30df9568d546a83c0e128a0c16ef7b96fb5ef7a6171

  • SSDEEP

    1536:VB+mVbcZgNDGKpK6S6EHU5e7zMb1ya+ORHduBRkphLZdk7txIfQFNixOj4brpQQE:+m1rN3K6SZHUPEa+m9MRkLLMXXHIPp5

Malware Config

Targets

    • Target

      a70b8c34747fbc47a18e6fac84e8aea90b7d026ee76fd224b529f5f378a90fff

    • Size

      94KB

    • MD5

      99f43174691b821453fab057fbe5929f

    • SHA1

      30b6e15bb4d7ee5571bb68bd4d82baf0592a9f80

    • SHA256

      a70b8c34747fbc47a18e6fac84e8aea90b7d026ee76fd224b529f5f378a90fff

    • SHA512

      1b01d5e66a769b1287bf7b96a85a16622ed19563c76feb2904c1b6785ab166fdd821a64d60ffd939c204b30df9568d546a83c0e128a0c16ef7b96fb5ef7a6171

    • SSDEEP

      1536:VB+mVbcZgNDGKpK6S6EHU5e7zMb1ya+ORHduBRkphLZdk7txIfQFNixOj4brpQQE:+m1rN3K6SZHUPEa+m9MRkLLMXXHIPp5

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks