General
-
Target
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496
-
Size
147KB
-
Sample
221002-q9te7shff7
-
MD5
63b0740a005dfde4922a4e3989dad369
-
SHA1
41113dea2b51234439f20a0e8f80365e5c001d12
-
SHA256
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496
-
SHA512
6b0cffd5a8f214b73b4f59123a7b1752956e592882db1ffb00449203f8ff21fe1c49ddc242975204fdd066a130db94f6aa08379953b52a9ae329337c0309c7d7
-
SSDEEP
3072:bzxiBaeYkkiOK2HPFPwKZqhUV4+ODiqwUXZ5ZvOv/E:h6u7P3Zqz+WX7ZmU
Behavioral task
behavioral1
Sample
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://66.55.89.148:8080/forum/viewtopic.php
http://66.55.89.149:8080/forum/viewtopic.php
-
payload_url
http://michielvanoppen.nl/ZqW3dBoV/efoa.exe
http://www.membershipmojo.com/eBw0AYLP/JNa4.exe
Targets
-
-
Target
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496
-
Size
147KB
-
MD5
63b0740a005dfde4922a4e3989dad369
-
SHA1
41113dea2b51234439f20a0e8f80365e5c001d12
-
SHA256
293514524e40cfc3502ee2220c2a1c5cc88acba717f40bc8bfe1dcf9d5305496
-
SHA512
6b0cffd5a8f214b73b4f59123a7b1752956e592882db1ffb00449203f8ff21fe1c49ddc242975204fdd066a130db94f6aa08379953b52a9ae329337c0309c7d7
-
SSDEEP
3072:bzxiBaeYkkiOK2HPFPwKZqhUV4+ODiqwUXZ5ZvOv/E:h6u7P3Zqz+WX7ZmU
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-