General
-
Target
ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a
-
Size
112KB
-
Sample
221003-a6mv9ahef2
-
MD5
4eb3b705f4668a832cdc52e78a4e4361
-
SHA1
41eba9d1afe41032b9bb9dd948148aefbe804f18
-
SHA256
ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a
-
SHA512
f08175e76ad7ac014f51897a3472d18195a24b3be5ca9a11af1b754834f4fd17c7976e8d0a6766e6d48c9f023deb353a692b8a4df6026c8d45cfebe269c303d4
-
SSDEEP
3072:Cj3eTCAUHXpzhkFMMpqjRJOuyUWY8PoN58s:Cj3eWLsFwjauf
Static task
static1
Behavioral task
behavioral1
Sample
ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://seolinkmarket.com/idx.php
http://liststitch.com/link.php
http://closedir.com/hotlink/img.php
http://closedir.com/hotlink/pics.php
Targets
-
-
Target
ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a
-
Size
112KB
-
MD5
4eb3b705f4668a832cdc52e78a4e4361
-
SHA1
41eba9d1afe41032b9bb9dd948148aefbe804f18
-
SHA256
ae5d396f061a4de6a02e3cd3e12a43e1fbe34a012ea2ff82c0eca5d04454329a
-
SHA512
f08175e76ad7ac014f51897a3472d18195a24b3be5ca9a11af1b754834f4fd17c7976e8d0a6766e6d48c9f023deb353a692b8a4df6026c8d45cfebe269c303d4
-
SSDEEP
3072:Cj3eTCAUHXpzhkFMMpqjRJOuyUWY8PoN58s:Cj3eWLsFwjauf
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-