General
-
Target
87b56a7261d7e7770f3789e9cdf775d306847388f0471aa47938da3ff0b8022a
-
Size
287KB
-
Sample
221201-b21f8agc5t
-
MD5
91a143f47d91b05d6121c90c8b154158
-
SHA1
314d9c533f74e3eb34498b4ed346ac676aa588d3
-
SHA256
87b56a7261d7e7770f3789e9cdf775d306847388f0471aa47938da3ff0b8022a
-
SHA512
d6e648a6b3042125c152ad8d424bf99a9cbcfb0150fef64e2ab5c37f7439063142d360825c3b79d8191dd96a12b6e39da0e073deea3cfdb599d000d7af85da76
-
SSDEEP
6144:J5hcTqRqL9bjkXbfb9aILY+15kx0kN4PkcULaBniG1Jugyd:DhgqY5aDmx0kW8ceMf1NY
Malware Config
Targets
-
-
Target
87b56a7261d7e7770f3789e9cdf775d306847388f0471aa47938da3ff0b8022a
-
Size
287KB
-
MD5
91a143f47d91b05d6121c90c8b154158
-
SHA1
314d9c533f74e3eb34498b4ed346ac676aa588d3
-
SHA256
87b56a7261d7e7770f3789e9cdf775d306847388f0471aa47938da3ff0b8022a
-
SHA512
d6e648a6b3042125c152ad8d424bf99a9cbcfb0150fef64e2ab5c37f7439063142d360825c3b79d8191dd96a12b6e39da0e073deea3cfdb599d000d7af85da76
-
SSDEEP
6144:J5hcTqRqL9bjkXbfb9aILY+15kx0kN4PkcULaBniG1Jugyd:DhgqY5aDmx0kW8ceMf1NY
Score10/10-
Modifies security service
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-