General

  • Target

    630b289d8040765652936cfd3ad23d09faae81b840dea6ea3adb2f5030f6770a

  • Size

    97KB

  • Sample

    221128-fyzsqsda5s

  • MD5

    1f8e3b6b0650969282ce35a85d497dee

  • SHA1

    b521e817ba8c44351ee4c239058aa15d63ac5016

  • SHA256

    630b289d8040765652936cfd3ad23d09faae81b840dea6ea3adb2f5030f6770a

  • SHA512

    bc605641f4c3cb957953d50c3a4997df43c92f759ab14bad74c8b7caa87b01c3a2107fbf4c4905bf905329e16198ca272dbe21c6b89616e972864fae0b97ccd3

  • SSDEEP

    1536:Xz5Pv6Z87SPl+uruDB48a8evLA94W1KS0y7MFrynenYeIokNihWAky4Az+bKza:j9ZWuDB48aJvsbBvYyneeokIEA+Ya

Malware Config

Targets

    • Target

      630b289d8040765652936cfd3ad23d09faae81b840dea6ea3adb2f5030f6770a

    • Size

      97KB

    • MD5

      1f8e3b6b0650969282ce35a85d497dee

    • SHA1

      b521e817ba8c44351ee4c239058aa15d63ac5016

    • SHA256

      630b289d8040765652936cfd3ad23d09faae81b840dea6ea3adb2f5030f6770a

    • SHA512

      bc605641f4c3cb957953d50c3a4997df43c92f759ab14bad74c8b7caa87b01c3a2107fbf4c4905bf905329e16198ca272dbe21c6b89616e972864fae0b97ccd3

    • SSDEEP

      1536:Xz5Pv6Z87SPl+uruDB48a8evLA94W1KS0y7MFrynenYeIokNihWAky4Az+bKza:j9ZWuDB48aJvsbBvYyneeokIEA+Ya

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks