General

  • Target

    77e1ccf77e16081593c846105ed6947a1725b4744810bbb39ef81bc6c44d25ef

  • Size

    106KB

  • Sample

    221202-xndaeshc71

  • MD5

    9aab384298382e9f7248531bea01e8f7

  • SHA1

    58f2fadc5593d4a802a6c5743f1356753ad1c9aa

  • SHA256

    77e1ccf77e16081593c846105ed6947a1725b4744810bbb39ef81bc6c44d25ef

  • SHA512

    5e029973ff0b71a20428a8cb66588c6e6c888f5015438b0d68309dae11da31cc03c45262213da6c9ff51f7bc2d49b9ca2578136062603e1589f20c3b2e3c2b29

  • SSDEEP

    3072:ycwge60bzfV8X10ZlQno5f3QtrA4TxKfPmJqiYIwEr:yctIfG10HQo5f3QtfTxU6qhIBr

Malware Config

Targets

    • Target

      77e1ccf77e16081593c846105ed6947a1725b4744810bbb39ef81bc6c44d25ef

    • Size

      106KB

    • MD5

      9aab384298382e9f7248531bea01e8f7

    • SHA1

      58f2fadc5593d4a802a6c5743f1356753ad1c9aa

    • SHA256

      77e1ccf77e16081593c846105ed6947a1725b4744810bbb39ef81bc6c44d25ef

    • SHA512

      5e029973ff0b71a20428a8cb66588c6e6c888f5015438b0d68309dae11da31cc03c45262213da6c9ff51f7bc2d49b9ca2578136062603e1589f20c3b2e3c2b29

    • SSDEEP

      3072:ycwge60bzfV8X10ZlQno5f3QtrA4TxKfPmJqiYIwEr:yctIfG10HQo5f3QtfTxU6qhIBr

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks