General
- Target Signed_POno20200625.doc
- Size 114KB
- Sample200625-6dfewmgth2
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
Score
10/10
Malware Config
Targets
-
- Target Signed_POno20200625.doc
- Size 114KB
- SHA256 759ef75e133383af768b2be302dc256ad4e6720fb64eda70af76954dd29caf73
Score10/10-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blacklisted process makes network request
-
Executes dropped EXE
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Use of msiexec (install) with remote resource
-
Checks for installed software on the system
-
Enumerates connected drives
-
Suspicious use of SetThreadContext