General
-
Target
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab
-
Size
134KB
-
Sample
221003-bb7gvabcgn
-
MD5
4aad8b6d8981f4eb1fb8ef1d75bccc90
-
SHA1
fe30bc59e22dbf8b07075d36ff13c2ab71a10f3f
-
SHA256
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab
-
SHA512
491f725f0812773fdde9ff39ed1767ab4a4270a237473957f0cbcd2ae20bff21eeaaeee40a7580cd02f28130adf97acdac0cffb2e33555b1872068ad4d00eaef
-
SSDEEP
3072:Q8A/iKZSK9/MnIAFWaA5Y100ZNftjc9g:JwiQFfAFPGYmiQ
Static task
static1
Behavioral task
behavioral1
Sample
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/forum/viewtopic.php
http://116.122.158.195:8080/forum/viewtopic.php
http://productsbylifestyle.com/forum/viewtopic.php
http://stormshuttersdiscount.com/forum/viewtopic.php
-
payload_url
http://www.kavalevent.com/CehCBf2.exe
http://jossboutique.fr/dq8k3nhy.exe
http://applehospital.com/gP9t.exe
http://spireportal.net/5ay2n.exe
http://spn.www.alpha.hostsg.com/eXa.exe
Targets
-
-
Target
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab
-
Size
134KB
-
MD5
4aad8b6d8981f4eb1fb8ef1d75bccc90
-
SHA1
fe30bc59e22dbf8b07075d36ff13c2ab71a10f3f
-
SHA256
8e1035a007619b5bf4d914ddda9f041b40b3f6cde24848578eb83b6f657a36ab
-
SHA512
491f725f0812773fdde9ff39ed1767ab4a4270a237473957f0cbcd2ae20bff21eeaaeee40a7580cd02f28130adf97acdac0cffb2e33555b1872068ad4d00eaef
-
SSDEEP
3072:Q8A/iKZSK9/MnIAFWaA5Y100ZNftjc9g:JwiQFfAFPGYmiQ
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-