General

  • Target

    85414f03693a38066ea192af8ae47a46faa5e1f35a64a9cdf2fd3466b57ba932

  • Size

    151KB

  • Sample

    221201-cpb4jaeg45

  • MD5

    849d2d7163581d5a1f939ad7ca6f5173

  • SHA1

    7989df240b28371f039afb84e0985e0400051633

  • SHA256

    85414f03693a38066ea192af8ae47a46faa5e1f35a64a9cdf2fd3466b57ba932

  • SHA512

    8af6eb42b9ed4f9da0ce128adf768b25d532d6978a128cd818f3549883d46cdb62ba389fead2a23387e791d62e13087d8d3a1db8935abe25563aa3f004c84ef7

  • SSDEEP

    3072:rzAa5EaqZJzBi57S5V4ulPfZPvA6M1PObZMlqeFweFjW:r/qGO5+ulnZP4X12bZMlZb

Malware Config

Targets

    • Target

      85414f03693a38066ea192af8ae47a46faa5e1f35a64a9cdf2fd3466b57ba932

    • Size

      151KB

    • MD5

      849d2d7163581d5a1f939ad7ca6f5173

    • SHA1

      7989df240b28371f039afb84e0985e0400051633

    • SHA256

      85414f03693a38066ea192af8ae47a46faa5e1f35a64a9cdf2fd3466b57ba932

    • SHA512

      8af6eb42b9ed4f9da0ce128adf768b25d532d6978a128cd818f3549883d46cdb62ba389fead2a23387e791d62e13087d8d3a1db8935abe25563aa3f004c84ef7

    • SSDEEP

      3072:rzAa5EaqZJzBi57S5V4ulPfZPvA6M1PObZMlqeFweFjW:r/qGO5+ulnZP4X12bZMlZb

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks