General

  • Target

    85d472054b48edfc408541567e7ef3385aea070ce78438c86f2ccefd441ceecf

  • Size

    121KB

  • Sample

    221201-b9z6esgh6x

  • MD5

    add47dc89cb96245d31b81968e2f4720

  • SHA1

    620e6cd23a32f7c2fc721d64c9ceab3513beca43

  • SHA256

    85d472054b48edfc408541567e7ef3385aea070ce78438c86f2ccefd441ceecf

  • SHA512

    997ac933a99a59e31d070093343865208b39aa5c357d2a0d2eebb04d04b68c9d7f95bee36b818687658d74fb17718c155e4e41baca35e14c418ac13b6dc0fa53

  • SSDEEP

    3072:3uz8L0wPWmHb7hDZg9VoU9GbqdlBqB+xig:3wsWO3htg9VJxd6U

Malware Config

Targets

    • Target

      85d472054b48edfc408541567e7ef3385aea070ce78438c86f2ccefd441ceecf

    • Size

      121KB

    • MD5

      add47dc89cb96245d31b81968e2f4720

    • SHA1

      620e6cd23a32f7c2fc721d64c9ceab3513beca43

    • SHA256

      85d472054b48edfc408541567e7ef3385aea070ce78438c86f2ccefd441ceecf

    • SHA512

      997ac933a99a59e31d070093343865208b39aa5c357d2a0d2eebb04d04b68c9d7f95bee36b818687658d74fb17718c155e4e41baca35e14c418ac13b6dc0fa53

    • SSDEEP

      3072:3uz8L0wPWmHb7hDZg9VoU9GbqdlBqB+xig:3wsWO3htg9VJxd6U

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks