General
-
Target
1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41
-
Size
96KB
-
Sample
221002-rem6dahhg7
-
MD5
6c84be59f2fd20c2dd456fca1bc708e0
-
SHA1
40d9df8edd1370c713ff6d51f72e06af1bdb8588
-
SHA256
1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41
-
SHA512
647d0bba85227578983a54bfa76d548c448060f94938b7f03c9bae3fc1c50fcab878befb1098f8709c2fb791a5e957ca6979ea93649961afecd36ee61e3ab969
-
SSDEEP
1536:aLU1TgMHAF6C1QC5s2DnTFwpnP8WSSQgOtSG3h3IR6mTBAUmzzcUOUhXFen/:J15nC5rbTupPwPI6tIR6mTBqdbL
Static task
static1
Behavioral task
behavioral1
Sample
1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://zkhmeps.pw:4915/doc/black.php
http://zkhmeps.pw:888/doc/black.php
-
payload_url
http://ckirmpu.pw:888/pic/Flash.exe
Targets
-
-
Target
1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41
-
Size
96KB
-
MD5
6c84be59f2fd20c2dd456fca1bc708e0
-
SHA1
40d9df8edd1370c713ff6d51f72e06af1bdb8588
-
SHA256
1b24e3b0063ce3aab6272514acfbedd16512d53f3c533084991bd266f8f27b41
-
SHA512
647d0bba85227578983a54bfa76d548c448060f94938b7f03c9bae3fc1c50fcab878befb1098f8709c2fb791a5e957ca6979ea93649961afecd36ee61e3ab969
-
SSDEEP
1536:aLU1TgMHAF6C1QC5s2DnTFwpnP8WSSQgOtSG3h3IR6mTBAUmzzcUOUhXFen/:J15nC5rbTupPwPI6tIR6mTBqdbL
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-