General

  • Target

    ca63169df1f881947741478b9f99bbba4a2c7c15baa81f8c2cba62f3c06a7b32

  • Size

    93KB

  • Sample

    221203-2c3hdseh21

  • MD5

    ca3623ab0f80ff09b366d57cc6504287

  • SHA1

    5ccdd18a87596d0840752855294cd51059f3fdbe

  • SHA256

    ca63169df1f881947741478b9f99bbba4a2c7c15baa81f8c2cba62f3c06a7b32

  • SHA512

    e36304ba33cefb8991110e030ac1ec60f01ef5ce90f1d4aa61819a87b50120413c0d724baa2c89b7bd8934949b443e208c3ad869abd3e7224b51e0ff22dd79ff

  • SSDEEP

    1536:JKo7fRW4OvOQOULcqXmcelESUAlJmdhrUfh0/cm0KGBwHDwS/NiyHrXqkTUYQE:NY4O2Q5camUSU0gMOcHwHrlHrR

Malware Config

Targets

    • Target

      ca63169df1f881947741478b9f99bbba4a2c7c15baa81f8c2cba62f3c06a7b32

    • Size

      93KB

    • MD5

      ca3623ab0f80ff09b366d57cc6504287

    • SHA1

      5ccdd18a87596d0840752855294cd51059f3fdbe

    • SHA256

      ca63169df1f881947741478b9f99bbba4a2c7c15baa81f8c2cba62f3c06a7b32

    • SHA512

      e36304ba33cefb8991110e030ac1ec60f01ef5ce90f1d4aa61819a87b50120413c0d724baa2c89b7bd8934949b443e208c3ad869abd3e7224b51e0ff22dd79ff

    • SSDEEP

      1536:JKo7fRW4OvOQOULcqXmcelESUAlJmdhrUfh0/cm0KGBwHDwS/NiyHrXqkTUYQE:NY4O2Q5camUSU0gMOcHwHrlHrR

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks