General
-
Target
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2
-
Size
123KB
-
Sample
221003-a8waeahfe7
-
MD5
6b17a8c6828f331930652aa9bae53d60
-
SHA1
2faee98c19174f9b03974ab3c59e509fef8661e6
-
SHA256
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2
-
SHA512
6d606fc26b8414cac9d9221749d592ec2c39e5d7678b835eab3f62c8575209aaaaba6c833c3210b53d0061852b0f3600e53799940bf984958862b5fc2e940bd5
-
SSDEEP
1536:jWkbMClgEICXCq8Nbib1Ao3e4ZZl2Di1H9ZLIBxdpnn1bohCiZSszbTR:jWcMClv4NbibC/4QYvLYLpn1Viksz
Static task
static1
Behavioral task
behavioral1
Sample
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/ponyb/gate.php
http://116.122.158.195:8080/ponyb/gate.php
http://hubbardsauto.net/ponyb/gate.php
http://irishhillstire.com/ponyb/gate.php
-
payload_url
http://ftp.chicagopatriotrun.com/gGrqX.exe
http://EZGOLFLESSONS.COM/CYvz.exe
http://www.sysdbs.com.br/X09.exe
http://ndhomeopathy.com/St27Etpt.exe
Targets
-
-
Target
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2
-
Size
123KB
-
MD5
6b17a8c6828f331930652aa9bae53d60
-
SHA1
2faee98c19174f9b03974ab3c59e509fef8661e6
-
SHA256
a0fa330e0b4dfb41769effba9776324b2521fe3a142078bfa41717d52b9d9ed2
-
SHA512
6d606fc26b8414cac9d9221749d592ec2c39e5d7678b835eab3f62c8575209aaaaba6c833c3210b53d0061852b0f3600e53799940bf984958862b5fc2e940bd5
-
SSDEEP
1536:jWkbMClgEICXCq8Nbib1Ao3e4ZZl2Di1H9ZLIBxdpnn1bohCiZSszbTR:jWcMClv4NbibC/4QYvLYLpn1Viksz
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-