General

  • Target

    11f91920cb519851359f8bc089ec25146a4cfb1b21cf78b79ff4475755004dd6

  • Size

    160KB

  • Sample

    221128-e4pz2seg27

  • MD5

    99f59304ddd53afb72ef0121fdb30ada

  • SHA1

    0c807be7617e455af1134f29a0ea885fcfa6870c

  • SHA256

    11f91920cb519851359f8bc089ec25146a4cfb1b21cf78b79ff4475755004dd6

  • SHA512

    ec3472b9caf98c60db40428217629a1063bab9b9ed99f53ec54852a971d3736775413d4ec553ebf2e5bbafc1dac270995156c189f7e87661983dc8a09d933071

  • SSDEEP

    3072:Ad2H60yC3R6tmESmQKTw3bJ7FVlIoV4FtVLwEX:AdBc3WmElQcw3bJ7BIoVkt5BX

Malware Config

Targets

    • Target

      11f91920cb519851359f8bc089ec25146a4cfb1b21cf78b79ff4475755004dd6

    • Size

      160KB

    • MD5

      99f59304ddd53afb72ef0121fdb30ada

    • SHA1

      0c807be7617e455af1134f29a0ea885fcfa6870c

    • SHA256

      11f91920cb519851359f8bc089ec25146a4cfb1b21cf78b79ff4475755004dd6

    • SHA512

      ec3472b9caf98c60db40428217629a1063bab9b9ed99f53ec54852a971d3736775413d4ec553ebf2e5bbafc1dac270995156c189f7e87661983dc8a09d933071

    • SSDEEP

      3072:Ad2H60yC3R6tmESmQKTw3bJ7FVlIoV4FtVLwEX:AdBc3WmElQcw3bJ7BIoVkt5BX

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks