General

  • Target

    747dbba40c1dae72e21b2183af8c4f6f6d21ba550c27752a63443713f937e8b8

  • Size

    195KB

  • Sample

    221202-xnllssdh24

  • MD5

    33fb5b25b9012c402b81fffc84909260

  • SHA1

    d8af92b631d3a8cf7d4641af29dad90703f2658c

  • SHA256

    747dbba40c1dae72e21b2183af8c4f6f6d21ba550c27752a63443713f937e8b8

  • SHA512

    02d6179b12e4eb7032386ac848195b2941eaf713dbb70c10dfe2aff44bff29d8f1e192850bb6a6a8ecc8a49d4d7b4a25653bfe95f04cc8ce5bd49e47a9f22e35

  • SSDEEP

    3072:YRg3HszTF6Slrkk03A4W1M6LhbVaUW8wJ:kgid9hZaUWt

Malware Config

Targets

    • Target

      747dbba40c1dae72e21b2183af8c4f6f6d21ba550c27752a63443713f937e8b8

    • Size

      195KB

    • MD5

      33fb5b25b9012c402b81fffc84909260

    • SHA1

      d8af92b631d3a8cf7d4641af29dad90703f2658c

    • SHA256

      747dbba40c1dae72e21b2183af8c4f6f6d21ba550c27752a63443713f937e8b8

    • SHA512

      02d6179b12e4eb7032386ac848195b2941eaf713dbb70c10dfe2aff44bff29d8f1e192850bb6a6a8ecc8a49d4d7b4a25653bfe95f04cc8ce5bd49e47a9f22e35

    • SSDEEP

      3072:YRg3HszTF6Slrkk03A4W1M6LhbVaUW8wJ:kgid9hZaUWt

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks