General
-
Target
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd
-
Size
134KB
-
Sample
221003-bkfeqaabe7
-
MD5
74adbcea42ce4b91beccfe799787a0f0
-
SHA1
aabba6afe2347363b50c7e5edc4b0cc39ce97b71
-
SHA256
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd
-
SHA512
7329818272866d899d38ea6a3c816166b8e52b39105da9365d5b96c319dd2fc236375d5330f30aa01b80107e1137049df647dd04ad4f1dea8442bd60fd3286a0
-
SSDEEP
3072:k1XWdjev/82Sl3vermeA/5E+m+3nngnDm2z:qX4ero/0+Xgn/
Static task
static1
Behavioral task
behavioral1
Sample
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/ponyz/gate.php
http://116.122.158.195:8080/ponyz/gate.php
http://productsbylifestyle.com/ponyz/gate.php
http://stormshuttersdiscount.com/ponyz/gate.php
-
payload_url
http://ftp.abssolute.net/t8Z7.exe
http://MinesSchefferville.ca/Jhu11.exe
http://kartoteka-tbns.com.pl/rnKTc.exe
Targets
-
-
Target
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd
-
Size
134KB
-
MD5
74adbcea42ce4b91beccfe799787a0f0
-
SHA1
aabba6afe2347363b50c7e5edc4b0cc39ce97b71
-
SHA256
6224e2f3eee51877786accbe28d82688054986006e4aaf5efa1e6abf96cd6bdd
-
SHA512
7329818272866d899d38ea6a3c816166b8e52b39105da9365d5b96c319dd2fc236375d5330f30aa01b80107e1137049df647dd04ad4f1dea8442bd60fd3286a0
-
SSDEEP
3072:k1XWdjev/82Sl3vermeA/5E+m+3nngnDm2z:qX4ero/0+Xgn/
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-