General

  • Target

    c1e866fb48b0a411cff52647b324d37c41cd538cb0c892b9766caafda215162f

  • Size

    151KB

  • Sample

    221203-q4zd9sfa33

  • MD5

    d016080ea23090e7ec69b54ffc7ee828

  • SHA1

    26dc28c6da1d552157ff657893d2b9d395f590bf

  • SHA256

    c1e866fb48b0a411cff52647b324d37c41cd538cb0c892b9766caafda215162f

  • SHA512

    f4d617ae59985bf4762ae54c4e4a3c086058584ca44f0fc2769d669f27cf4329223f43dd0ee09861d8f4e5431d5d84c542984a8832aca7ff777b2f59353654ad

  • SSDEEP

    3072:qzAa5EaqZHzRm97dtpXTnW3LZSzBBu6qigM+UXK21jW:q/qYBtpjnW7ZSdBRJgM+m

Malware Config

Targets

    • Target

      c1e866fb48b0a411cff52647b324d37c41cd538cb0c892b9766caafda215162f

    • Size

      151KB

    • MD5

      d016080ea23090e7ec69b54ffc7ee828

    • SHA1

      26dc28c6da1d552157ff657893d2b9d395f590bf

    • SHA256

      c1e866fb48b0a411cff52647b324d37c41cd538cb0c892b9766caafda215162f

    • SHA512

      f4d617ae59985bf4762ae54c4e4a3c086058584ca44f0fc2769d669f27cf4329223f43dd0ee09861d8f4e5431d5d84c542984a8832aca7ff777b2f59353654ad

    • SSDEEP

      3072:qzAa5EaqZHzRm97dtpXTnW3LZSzBBu6qigM+UXK21jW:q/qYBtpjnW7ZSdBRJgM+m

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks