General
-
Target
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2
-
Size
120KB
-
Sample
221001-z5marshccj
-
MD5
6af8e5891dd8a9b40ec939324cdb8bf9
-
SHA1
56e469256c39f91a1ac5ba093329d949a4e706da
-
SHA256
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2
-
SHA512
22f36042173ec1e1cfaf70f0e010de6a8d88c9e575d7939af69ffd183041c2ea9b5b7810dbbceced0f8710c555f8917bdc8efb1d62c84f65513b6c949a99cfa4
-
SSDEEP
1536:z4GX3PiPLtnqmu6ycsuGj2BqRKVR3l/2NGck5NbjwdM5euiv5pzdFczKcI:zfX3PiPxqmOcsuGjZRk4/kTbUQFiI+h
Static task
static1
Behavioral task
behavioral1
Sample
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
pony
http://www.arki.com:8080/ponyz/gate.php
http://arki.com:8080/ponyz/gate.php
http://50.57.185.72:8080/ponyz/gate.php
http://goldendns.net/ponyz/gate.php
-
payload_url
http://www.healtheducationproductions.com/33Th.exe
http://colinwud.com/buKadE.exe
http://visualsystem.de/mZPv.exe
Targets
-
-
Target
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2
-
Size
120KB
-
MD5
6af8e5891dd8a9b40ec939324cdb8bf9
-
SHA1
56e469256c39f91a1ac5ba093329d949a4e706da
-
SHA256
7c56c605b8fe9d6831d4d219a61f23778e18490620235863e014f19a3dc90bb2
-
SHA512
22f36042173ec1e1cfaf70f0e010de6a8d88c9e575d7939af69ffd183041c2ea9b5b7810dbbceced0f8710c555f8917bdc8efb1d62c84f65513b6c949a99cfa4
-
SSDEEP
1536:z4GX3PiPLtnqmu6ycsuGj2BqRKVR3l/2NGck5NbjwdM5euiv5pzdFczKcI:zfX3PiPxqmOcsuGjZRk4/kTbUQFiI+h
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-