General
-
Target
865f05f2a8edcbcc01069ba9a6393ee39d343a93f3479ca3a6931fa62cef58ba
-
Size
297KB
-
Sample
221201-ck88gahh7z
-
MD5
f7649e49ea117abc5d6f3cb0e39a6d2d
-
SHA1
b775d39394a086a4a15b57e07adbe09614bc1e02
-
SHA256
865f05f2a8edcbcc01069ba9a6393ee39d343a93f3479ca3a6931fa62cef58ba
-
SHA512
ae23a3c05baff2c034385bc3be054cffd0f04eecb128135ae6ca00cf995dc5bdd8106a71b547bf1797cfc44b363d663abc1ae6214e0473291064006e26b82061
-
SSDEEP
6144:uZakqx71ooob+J8bZWXxy4936wDIdOD5paMc4UV03jTdXj8C:iaFLooob+JOkXs5oD5pa94UV03jTZj
Malware Config
Targets
-
-
Target
865f05f2a8edcbcc01069ba9a6393ee39d343a93f3479ca3a6931fa62cef58ba
-
Size
297KB
-
MD5
f7649e49ea117abc5d6f3cb0e39a6d2d
-
SHA1
b775d39394a086a4a15b57e07adbe09614bc1e02
-
SHA256
865f05f2a8edcbcc01069ba9a6393ee39d343a93f3479ca3a6931fa62cef58ba
-
SHA512
ae23a3c05baff2c034385bc3be054cffd0f04eecb128135ae6ca00cf995dc5bdd8106a71b547bf1797cfc44b363d663abc1ae6214e0473291064006e26b82061
-
SSDEEP
6144:uZakqx71ooob+J8bZWXxy4936wDIdOD5paMc4UV03jTdXj8C:iaFLooob+JOkXs5oD5pa94UV03jTZj
Score10/10-
Modifies security service
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-