General

  • Target

    f35255967344623ec6c76e7369d703ce58f38cefd6cf12185b52007fe262f801

  • Size

    172KB

  • Sample

    221201-tl1fdsaa6x

  • MD5

    60bbaf05a973ca99cb47e3268772f81b

  • SHA1

    435faaf5f593c1ad909da4acdeb8c9ae0e3bde89

  • SHA256

    f35255967344623ec6c76e7369d703ce58f38cefd6cf12185b52007fe262f801

  • SHA512

    af55c2f18714c715145869a1fd0f14fb47243f8f983d3a2ab205e62a211de484dbd1476be8925cc517be45bdc7fef70434e5b2505ff49601af3838d30fad432c

  • SSDEEP

    3072:+CYOvCa5Lj7TsjzEBNCdvxU2/GkYX4ymD8g:+C5vLB7QzS9aGDobg

Malware Config

Targets

    • Target

      f35255967344623ec6c76e7369d703ce58f38cefd6cf12185b52007fe262f801

    • Size

      172KB

    • MD5

      60bbaf05a973ca99cb47e3268772f81b

    • SHA1

      435faaf5f593c1ad909da4acdeb8c9ae0e3bde89

    • SHA256

      f35255967344623ec6c76e7369d703ce58f38cefd6cf12185b52007fe262f801

    • SHA512

      af55c2f18714c715145869a1fd0f14fb47243f8f983d3a2ab205e62a211de484dbd1476be8925cc517be45bdc7fef70434e5b2505ff49601af3838d30fad432c

    • SSDEEP

      3072:+CYOvCa5Lj7TsjzEBNCdvxU2/GkYX4ymD8g:+C5vLB7QzS9aGDobg

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks