General
-
Target
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994
-
Size
130KB
-
Sample
221001-2ys6vaccbq
-
MD5
6e222cf7d9fb6e9a6b561ecd5a3db8a0
-
SHA1
29970241a6d08be901c379726c90344e04fd76ba
-
SHA256
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994
-
SHA512
1f34f2ab6580acae13d1450572bd807000f7fa32e3888ac5f70f933a4cfbafe9eac2bdbe090c38f00cdfb9ccbd38148f4ead712b88f7b5a129f61605cd46a68e
-
SSDEEP
3072:UpJCHVkQh+F+kOg6IF65xw552Up7zScZkQbyxSI:eyVkkko5CnpHScZkCyZ
Static task
static1
Behavioral task
behavioral1
Sample
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/forum/viewtopic.php
http://116.122.158.195:8080/forum/viewtopic.php
http://bridgewatertire.com/forum/viewtopic.php
http://buycoopertires.com/forum/viewtopic.php
-
payload_url
http://www.kavalevent.com/CehCBf2.exe
http://jossboutique.fr/dq8k3nhy.exe
http://applehospital.com/gP9t.exe
http://spireportal.net/5ay2n.exe
http://ray.tc/ZZasL.exe
Targets
-
-
Target
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994
-
Size
130KB
-
MD5
6e222cf7d9fb6e9a6b561ecd5a3db8a0
-
SHA1
29970241a6d08be901c379726c90344e04fd76ba
-
SHA256
20a71f01fc6e51404b29985a04af085b1d9611a1e9413103cf477fc7c159e994
-
SHA512
1f34f2ab6580acae13d1450572bd807000f7fa32e3888ac5f70f933a4cfbafe9eac2bdbe090c38f00cdfb9ccbd38148f4ead712b88f7b5a129f61605cd46a68e
-
SSDEEP
3072:UpJCHVkQh+F+kOg6IF65xw552Up7zScZkQbyxSI:eyVkkko5CnpHScZkCyZ
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-