General
-
Target
84122c5935a5629b1488b86fd91e6172ef837e638c96fecc39ce11e081f011b9
-
Size
324KB
-
Sample
221003-bdk2mabdcp
-
MD5
742403448700b70277fec53e409d930b
-
SHA1
c44a6848cf090645e976c466d8a9a27827cac1c7
-
SHA256
84122c5935a5629b1488b86fd91e6172ef837e638c96fecc39ce11e081f011b9
-
SHA512
723e17db4488d517c97aff018ef25dacedc5aa1b4b392aea1af9cb756068f2b9b47ac590a4146c861690127d2faf9574240ab6fe62164edb7efe9d3bf957f943
-
SSDEEP
6144:tAxH4qmgWyy+Y6uZ4g/VqhxNH/HR9cqasnxnw:4Yx+0W
Static task
static1
Behavioral task
behavioral1
Sample
84122c5935a5629b1488b86fd91e6172ef837e638c96fecc39ce11e081f011b9.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://skrumaz.com:8080/forum/viewtopic.php
-
payload_url
http://ftp.deltalegis.com/exits/mantel.exe
http://www.tstn.org/bootblack/writing.exe
http://nkgamers.com/swazi/banalities.exe
Targets
-
-
Target
84122c5935a5629b1488b86fd91e6172ef837e638c96fecc39ce11e081f011b9
-
Size
324KB
-
MD5
742403448700b70277fec53e409d930b
-
SHA1
c44a6848cf090645e976c466d8a9a27827cac1c7
-
SHA256
84122c5935a5629b1488b86fd91e6172ef837e638c96fecc39ce11e081f011b9
-
SHA512
723e17db4488d517c97aff018ef25dacedc5aa1b4b392aea1af9cb756068f2b9b47ac590a4146c861690127d2faf9574240ab6fe62164edb7efe9d3bf957f943
-
SSDEEP
6144:tAxH4qmgWyy+Y6uZ4g/VqhxNH/HR9cqasnxnw:4Yx+0W
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-