General

  • Target

    c650a953134b631f4570a0e2f68d76caf1a48ba0e87e4ff1bef0993dc1d42317

  • Size

    179KB

  • Sample

    221203-f2mmksgg86

  • MD5

    5d78ae955382f2291ef5decdefc305ef

  • SHA1

    00719c65114c6e48bd8de4722b9453c1dfb6d44e

  • SHA256

    c650a953134b631f4570a0e2f68d76caf1a48ba0e87e4ff1bef0993dc1d42317

  • SHA512

    4597e91a8d5ff1f718e742f263900f0c53d8fd980318775b89d9c25b6ef5dcdad75b33e69eacb2d42d40f784b774af57fc631d50aadfc9f9c33f005255791457

  • SSDEEP

    3072:G7U+t2oQHUl8IGINlcrnoW4CCs74vXRWgv2TEK85x:yUvoMUuGGB4o4sg28j

Malware Config

Targets

    • Target

      c650a953134b631f4570a0e2f68d76caf1a48ba0e87e4ff1bef0993dc1d42317

    • Size

      179KB

    • MD5

      5d78ae955382f2291ef5decdefc305ef

    • SHA1

      00719c65114c6e48bd8de4722b9453c1dfb6d44e

    • SHA256

      c650a953134b631f4570a0e2f68d76caf1a48ba0e87e4ff1bef0993dc1d42317

    • SHA512

      4597e91a8d5ff1f718e742f263900f0c53d8fd980318775b89d9c25b6ef5dcdad75b33e69eacb2d42d40f784b774af57fc631d50aadfc9f9c33f005255791457

    • SSDEEP

      3072:G7U+t2oQHUl8IGINlcrnoW4CCs74vXRWgv2TEK85x:yUvoMUuGGB4o4sg28j

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Tasks