General

  • Target

    c42d210a84c1ff300f8b5470fc5b3553df944ad6e4b729ba2b30343b284757fe

  • Size

    154KB

  • Sample

    221203-akx44aca5y

  • MD5

    bd9613fd87e238adba45190438329396

  • SHA1

    7b8aa6b66ada8c89cd84e2e999c8b0ad94e5b114

  • SHA256

    c42d210a84c1ff300f8b5470fc5b3553df944ad6e4b729ba2b30343b284757fe

  • SHA512

    3b585f5ab6f88e660aaf6a3c82317231e7c634bdae77fc9ecf5e941ec3879334026172e681b8ab0a6f62f39f3a21fd40e515703f85714760e98b191492bbecb5

  • SSDEEP

    3072:E4W5H4mNr9+819Ih/vxPNowmbpVOhKXFG26:RW3r9xFb3AKXX6

Malware Config

Targets

    • Target

      c42d210a84c1ff300f8b5470fc5b3553df944ad6e4b729ba2b30343b284757fe

    • Size

      154KB

    • MD5

      bd9613fd87e238adba45190438329396

    • SHA1

      7b8aa6b66ada8c89cd84e2e999c8b0ad94e5b114

    • SHA256

      c42d210a84c1ff300f8b5470fc5b3553df944ad6e4b729ba2b30343b284757fe

    • SHA512

      3b585f5ab6f88e660aaf6a3c82317231e7c634bdae77fc9ecf5e941ec3879334026172e681b8ab0a6f62f39f3a21fd40e515703f85714760e98b191492bbecb5

    • SSDEEP

      3072:E4W5H4mNr9+819Ih/vxPNowmbpVOhKXFG26:RW3r9xFb3AKXX6

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks