General

  • Target

    c8503ea84e992efd7b2cf239bfb29711960ca4a6790f5f7c6caa3f8b4ddd361e

  • Size

    156KB

  • Sample

    221203-ftmbvabe7v

  • MD5

    6f26d8d1bcee8c7575abf6723b68f5f0

  • SHA1

    2aec82ccc0294a8820778b536ce526012f30da74

  • SHA256

    c8503ea84e992efd7b2cf239bfb29711960ca4a6790f5f7c6caa3f8b4ddd361e

  • SHA512

    7eb12f9b1f8a98ef8a1b7a44b22cd948383401d4a8ba2dd6eef666434a2a4bf8e131eef7024298ff2caa21ce2f9167ee172cfd720dc3f2600cb2ba510c3e7008

  • SSDEEP

    3072:RazR/tIq/RftiMwj9KhxC9xUnGOUKdlyCX5kMPOxylt:Rat/tt1tKj9cFGOBa

Malware Config

Targets

    • Target

      c8503ea84e992efd7b2cf239bfb29711960ca4a6790f5f7c6caa3f8b4ddd361e

    • Size

      156KB

    • MD5

      6f26d8d1bcee8c7575abf6723b68f5f0

    • SHA1

      2aec82ccc0294a8820778b536ce526012f30da74

    • SHA256

      c8503ea84e992efd7b2cf239bfb29711960ca4a6790f5f7c6caa3f8b4ddd361e

    • SHA512

      7eb12f9b1f8a98ef8a1b7a44b22cd948383401d4a8ba2dd6eef666434a2a4bf8e131eef7024298ff2caa21ce2f9167ee172cfd720dc3f2600cb2ba510c3e7008

    • SSDEEP

      3072:RazR/tIq/RftiMwj9KhxC9xUnGOUKdlyCX5kMPOxylt:Rat/tt1tKj9cFGOBa

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks