General

  • Target

    39dd5c73502cc3c299b50705c1accf895b58258c5f700207bdc12c646610d050

  • Size

    207KB

  • Sample

    221128-mpkqsacd2x

  • MD5

    7706d15f8614acabaf36f75b08f3f0cf

  • SHA1

    a67f063eb483a87c1c8964be3d331ac4f5a8a9ad

  • SHA256

    39dd5c73502cc3c299b50705c1accf895b58258c5f700207bdc12c646610d050

  • SHA512

    2c1f44ed81e95cae33586908b96d4bc43bd514dec7e3075053a45c2796e8cf151e8b9012ca5bb91fd21c01276086d1442b90a096b0e88efa2f72430029370f2b

  • SSDEEP

    6144:CakOb3OpM06TL3SR+JFCDIXYgQ7+aDeaD0aDvaDC:vkqcMtTO+bCDYLeH5GC

Malware Config

Targets

    • Target

      39dd5c73502cc3c299b50705c1accf895b58258c5f700207bdc12c646610d050

    • Size

      207KB

    • MD5

      7706d15f8614acabaf36f75b08f3f0cf

    • SHA1

      a67f063eb483a87c1c8964be3d331ac4f5a8a9ad

    • SHA256

      39dd5c73502cc3c299b50705c1accf895b58258c5f700207bdc12c646610d050

    • SHA512

      2c1f44ed81e95cae33586908b96d4bc43bd514dec7e3075053a45c2796e8cf151e8b9012ca5bb91fd21c01276086d1442b90a096b0e88efa2f72430029370f2b

    • SSDEEP

      6144:CakOb3OpM06TL3SR+JFCDIXYgQ7+aDeaD0aDvaDC:vkqcMtTO+bCDYLeH5GC

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks