General
-
Target
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6
-
Size
137KB
-
Sample
221003-by8nesccfr
-
MD5
6718a099ac51d51f21a3ffd6d86fc3ac
-
SHA1
f506a1d844b2ab998a2686fe168f5bfaa7e69247
-
SHA256
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6
-
SHA512
468d8e320654d3d101f5f37df43f250b218b8e3a418e11d4ec9ce9aff2d5299a435333049485ae2cae5cff6ae76a9f642837a58fc71e777f679fb9a9c36b8b78
-
SSDEEP
3072:BMNnXFk53U6Jkqstk2I2KdcFcBv8DVvlD2NvbZri:RGqsttgWcB4EZri
Static task
static1
Behavioral task
behavioral1
Sample
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://angels-mail.com:8080/forum/viewtopic.php
http://mail.yaklasim.com:8080/forum/viewtopic.php
http://palmspringscondovacationrentals.com/forum/viewtopic.php
http://luxuryvacationrentalpalmsprings.com/forum/viewtopic.php
-
payload_url
http://boardtech.gr/uZDyQ.exe
http://pictures.kfv-sk.de/fj7v.exe
http://workingschool.dk/3P9vy.exe
Targets
-
-
Target
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6
-
Size
137KB
-
MD5
6718a099ac51d51f21a3ffd6d86fc3ac
-
SHA1
f506a1d844b2ab998a2686fe168f5bfaa7e69247
-
SHA256
173af8bf5a52da3ddd345f835cc3ff8b1803a19d4dc86edd3af91305e0b072e6
-
SHA512
468d8e320654d3d101f5f37df43f250b218b8e3a418e11d4ec9ce9aff2d5299a435333049485ae2cae5cff6ae76a9f642837a58fc71e777f679fb9a9c36b8b78
-
SSDEEP
3072:BMNnXFk53U6Jkqstk2I2KdcFcBv8DVvlD2NvbZri:RGqsttgWcB4EZri
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-