General

  • Target

    5cf10a2f4c44b2c77469252dca13510f30b16e8f0557fb4e17b6273b2bf3e6db

  • Size

    159KB

  • Sample

    221128-e4q74sag6v

  • MD5

    d31319611c67989928cb112804fa8b6b

  • SHA1

    46881f5987befec9543bc10e1327ab7a77392104

  • SHA256

    5cf10a2f4c44b2c77469252dca13510f30b16e8f0557fb4e17b6273b2bf3e6db

  • SHA512

    957b8124ab91aa4ce5e0070eadc1538c7091a22049400dcff10dd56acac66d64f9f0c45c9884c17ed9931ac53c732a603a3154c3502bb5ec1be5d96734228d58

  • SSDEEP

    3072:NhnrlDMnOV9BcfNDpFoo3RZNIO29YYJ70P6o:Nh5BVHSuo3NI1Ru

Malware Config

Targets

    • Target

      5cf10a2f4c44b2c77469252dca13510f30b16e8f0557fb4e17b6273b2bf3e6db

    • Size

      159KB

    • MD5

      d31319611c67989928cb112804fa8b6b

    • SHA1

      46881f5987befec9543bc10e1327ab7a77392104

    • SHA256

      5cf10a2f4c44b2c77469252dca13510f30b16e8f0557fb4e17b6273b2bf3e6db

    • SHA512

      957b8124ab91aa4ce5e0070eadc1538c7091a22049400dcff10dd56acac66d64f9f0c45c9884c17ed9931ac53c732a603a3154c3502bb5ec1be5d96734228d58

    • SSDEEP

      3072:NhnrlDMnOV9BcfNDpFoo3RZNIO29YYJ70P6o:Nh5BVHSuo3NI1Ru

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks