General

  • Target

    b8e70910cb3f39f09068fe351740c9a2491b7335aa5d2f373b6fe51500e0b9e7

  • Size

    175KB

  • Sample

    221203-hcqztafg6y

  • MD5

    9d09d1adb71388a6397f8ae86969a9a1

  • SHA1

    1cb19d27274894bc8643df4a200a5d4c1a3b5243

  • SHA256

    b8e70910cb3f39f09068fe351740c9a2491b7335aa5d2f373b6fe51500e0b9e7

  • SHA512

    8036907adf6a688e1bfa61ab4a760077398a6c9eb6bc473e958ee274d706bcdec7ce8c40e40866d3ddf4aeab56a4ed79cc3011a7582631ec11d2b362df092e42

  • SSDEEP

    3072:YfyGUSpMijA/r4rntzuo7r67PTaIMNdCh+jCiiZOLNezb/:2yGUcMkA/r4rtzuo7O7POPxGd

Malware Config

Targets

    • Target

      b8e70910cb3f39f09068fe351740c9a2491b7335aa5d2f373b6fe51500e0b9e7

    • Size

      175KB

    • MD5

      9d09d1adb71388a6397f8ae86969a9a1

    • SHA1

      1cb19d27274894bc8643df4a200a5d4c1a3b5243

    • SHA256

      b8e70910cb3f39f09068fe351740c9a2491b7335aa5d2f373b6fe51500e0b9e7

    • SHA512

      8036907adf6a688e1bfa61ab4a760077398a6c9eb6bc473e958ee274d706bcdec7ce8c40e40866d3ddf4aeab56a4ed79cc3011a7582631ec11d2b362df092e42

    • SSDEEP

      3072:YfyGUSpMijA/r4rntzuo7r67PTaIMNdCh+jCiiZOLNezb/:2yGUcMkA/r4rtzuo7O7POPxGd

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks