General
-
Target
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08
-
Size
144KB
-
Sample
221003-b3j6macear
-
MD5
6354f8babfca537c94e4b9111d5b16f0
-
SHA1
3f311aec0a70466860bc0a704e252743c27f19d6
-
SHA256
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08
-
SHA512
bcc5fb5d1f5d0cc79b0a75713823c18843a197edb0b5d850b5b081f0618d027544c9aea9cada61e2574ae1f000c175b37472e7f4a4bcde30e799c95d0b320117
-
SSDEEP
3072:0jlKZelTDnInRZfZ+patRDUgO4Ryb3nqbttfpaJCa18E:4welkRZR+gtWU0bXOxah
Behavioral task
behavioral1
Sample
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
pony
http://74.53.97.66:8080/forum/viewtopic.php
http://74.53.97.67:8080/forum/viewtopic.php
-
payload_url
http://www.obvjutphaas.nl/wQ7T.exe
http://r555.info/41LMMbt5.exe
Targets
-
-
Target
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08
-
Size
144KB
-
MD5
6354f8babfca537c94e4b9111d5b16f0
-
SHA1
3f311aec0a70466860bc0a704e252743c27f19d6
-
SHA256
00ffccbd600cb04826d46a161b2e7c325c9ac2ebfca1821b9c373f4d0297bb08
-
SHA512
bcc5fb5d1f5d0cc79b0a75713823c18843a197edb0b5d850b5b081f0618d027544c9aea9cada61e2574ae1f000c175b37472e7f4a4bcde30e799c95d0b320117
-
SSDEEP
3072:0jlKZelTDnInRZfZ+patRDUgO4Ryb3nqbttfpaJCa18E:4welkRZR+gtWU0bXOxah
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-