General

  • Target

    c7be29c4beb65541f1d5fdf5bcb8a5c2f23f7d7f7439f6a5bc4bb7af4f5fb027

  • Size

    125KB

  • Sample

    221201-wgyr4sdd88

  • MD5

    ce8ab9ba33302b6a658c8fd68f899d5a

  • SHA1

    174267e986b53a7b1e435abf543bbb9577628d77

  • SHA256

    c7be29c4beb65541f1d5fdf5bcb8a5c2f23f7d7f7439f6a5bc4bb7af4f5fb027

  • SHA512

    e1e49e2a22a1c5cecfa5d88dab5a9edab5162c6785db82b019adc04eec96fb34a073567fa712e8abe158e611880aa038caf88c288c4a04fa33c68c5ed33ae67a

  • SSDEEP

    3072:8IKxlRm1G4sBN2R+7pLdQVlRHdC5CxKjvpyTwp:OlGRuVoHap

Malware Config

Targets

    • Target

      c7be29c4beb65541f1d5fdf5bcb8a5c2f23f7d7f7439f6a5bc4bb7af4f5fb027

    • Size

      125KB

    • MD5

      ce8ab9ba33302b6a658c8fd68f899d5a

    • SHA1

      174267e986b53a7b1e435abf543bbb9577628d77

    • SHA256

      c7be29c4beb65541f1d5fdf5bcb8a5c2f23f7d7f7439f6a5bc4bb7af4f5fb027

    • SHA512

      e1e49e2a22a1c5cecfa5d88dab5a9edab5162c6785db82b019adc04eec96fb34a073567fa712e8abe158e611880aa038caf88c288c4a04fa33c68c5ed33ae67a

    • SSDEEP

      3072:8IKxlRm1G4sBN2R+7pLdQVlRHdC5CxKjvpyTwp:OlGRuVoHap

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks