General

  • Target

    db4e8454f895df2db0265f2d4ff69a2d

  • Size

    93KB

  • Sample

    240321-lmz71saa5z

  • MD5

    db4e8454f895df2db0265f2d4ff69a2d

  • SHA1

    7cc9c24749ba59238fcbb9e3875dfbcffc294359

  • SHA256

    4443e38e79357f4eae1cfd2b0799785faae9dfe506ab3eea8db0bec0da32f4e0

  • SHA512

    80bfc8f3d7bb7dcda582f8187e7d6f358cafcdd9729c4299837f783da105e8f4e251f34b2a1617d7c17e8bab63872751f59c8a402e4c9aa27aaba722024d4dbc

  • SSDEEP

    1536:RszSiVM8oqDtcZwWCNMsZDUd+imkMEN5+3X6UgNqhrxX:2zpoUtcZGmsZ7TB3MNqht

Malware Config

Targets

    • Target

      db4e8454f895df2db0265f2d4ff69a2d

    • Size

      93KB

    • MD5

      db4e8454f895df2db0265f2d4ff69a2d

    • SHA1

      7cc9c24749ba59238fcbb9e3875dfbcffc294359

    • SHA256

      4443e38e79357f4eae1cfd2b0799785faae9dfe506ab3eea8db0bec0da32f4e0

    • SHA512

      80bfc8f3d7bb7dcda582f8187e7d6f358cafcdd9729c4299837f783da105e8f4e251f34b2a1617d7c17e8bab63872751f59c8a402e4c9aa27aaba722024d4dbc

    • SSDEEP

      1536:RszSiVM8oqDtcZwWCNMsZDUd+imkMEN5+3X6UgNqhrxX:2zpoUtcZGmsZ7TB3MNqht

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks