General
-
Target
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c
-
Size
135KB
-
Sample
221003-bz2w9sage3
-
MD5
6f8bba00d292765b165ebf97821c1c00
-
SHA1
86f7ef5f0c071a76f9db0a5764f1617347235443
-
SHA256
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c
-
SHA512
bbb207989599b0c5176b4fca5c43b9ebca36dd2677ca45b3fcbe60026d375ec915b14aaef0ce866be7dd517145889f1f4358dba5c34208da65c42a1d1b2afab4
-
SSDEEP
3072:TLOaqwVZR8rnLnY5Mn4HiSqEwQdiGvJBRDfxkx:vOMVZR405tiSckBVxkx
Static task
static1
Behavioral task
behavioral1
Sample
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/forum/viewtopic.php
http://116.122.158.195:8080/forum/viewtopic.php
http://lifestyleftmyers.com/forum/viewtopic.php
http://awesomeuniforms.com/forum/viewtopic.php
-
payload_url
http://attorneymcbride.com/c0ebcG.exe
http://solucionwebs.com/vrJA.exe
http://chris-cross.de/xZtGB8t.exe
Targets
-
-
Target
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c
-
Size
135KB
-
MD5
6f8bba00d292765b165ebf97821c1c00
-
SHA1
86f7ef5f0c071a76f9db0a5764f1617347235443
-
SHA256
12058a5c521471159a14059c9d4bf63719de1238353b3f6983dd4b2becc05f0c
-
SHA512
bbb207989599b0c5176b4fca5c43b9ebca36dd2677ca45b3fcbe60026d375ec915b14aaef0ce866be7dd517145889f1f4358dba5c34208da65c42a1d1b2afab4
-
SSDEEP
3072:TLOaqwVZR8rnLnY5Mn4HiSqEwQdiGvJBRDfxkx:vOMVZR405tiSckBVxkx
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-