General
-
Target
87df9274c0946b6bcad72f2fd5a3637cac3b363e834fe21e2051f1a370d5d856
-
Size
273KB
-
Sample
221201-cfq64ahe2x
-
MD5
c5ec8d4d5fad12590b5cdb5a3b504916
-
SHA1
07818943402a40cf76b0846d21114ca6012ef5ef
-
SHA256
87df9274c0946b6bcad72f2fd5a3637cac3b363e834fe21e2051f1a370d5d856
-
SHA512
5dd22d8df70b65494997d0f5d7b195b585f55e29b7163c342af4f1e50cced8d9a8bc2b7fffb0ef8f463709b6f66cc5c3e4e4849d477434e11444f312469d5aa5
-
SSDEEP
6144:d6Jm3BEjRBFwruVHlm6rssXV/diQhkJSnjF8BfiEFr6vilX:4mREjSSVHlm6Y6/dFkJSjitiEEax
Malware Config
Targets
-
-
Target
87df9274c0946b6bcad72f2fd5a3637cac3b363e834fe21e2051f1a370d5d856
-
Size
273KB
-
MD5
c5ec8d4d5fad12590b5cdb5a3b504916
-
SHA1
07818943402a40cf76b0846d21114ca6012ef5ef
-
SHA256
87df9274c0946b6bcad72f2fd5a3637cac3b363e834fe21e2051f1a370d5d856
-
SHA512
5dd22d8df70b65494997d0f5d7b195b585f55e29b7163c342af4f1e50cced8d9a8bc2b7fffb0ef8f463709b6f66cc5c3e4e4849d477434e11444f312469d5aa5
-
SSDEEP
6144:d6Jm3BEjRBFwruVHlm6rssXV/diQhkJSnjF8BfiEFr6vilX:4mREjSSVHlm6Y6/dFkJSjitiEEax
Score10/10-
Modifies security service
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-