General
-
Target
0fa6f46d6c88370de584678cbbc5047ea6c5576cf97867fb64464bd87e31c9b7
-
Size
90KB
-
Sample
221126-fgp7zach83
-
MD5
c4757e33a8280ab0885b0b5409eb6824
-
SHA1
b44910f28d0713567c9b950f2f6c15bea07a3720
-
SHA256
0fa6f46d6c88370de584678cbbc5047ea6c5576cf97867fb64464bd87e31c9b7
-
SHA512
39bbd8060018f25216d833682b91ddea3a5d8721d6d64630faa946584e60c3259e51115f5fd721f0daf7742c0a9b149c9da9ac1a2909195f07b4be470c20b2c6
-
SSDEEP
1536:9dCccB9mqTccu2LehTLMlt8dlQCiBrYO8cLJTvYEghkzm6W:bCc0Y2qTLMlSq8OaEg96W
Behavioral task
behavioral1
Sample
0fa6f46d6c88370de584678cbbc5047ea6c5576cf97867fb64464bd87e31c9b7.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://login.ministryofvapes.com/administrator/gate.php
-
payload_url
http://login.ministryofvapes.com/administrator/Pony.exe
Targets
-
-
Target
0fa6f46d6c88370de584678cbbc5047ea6c5576cf97867fb64464bd87e31c9b7
-
Size
90KB
-
MD5
c4757e33a8280ab0885b0b5409eb6824
-
SHA1
b44910f28d0713567c9b950f2f6c15bea07a3720
-
SHA256
0fa6f46d6c88370de584678cbbc5047ea6c5576cf97867fb64464bd87e31c9b7
-
SHA512
39bbd8060018f25216d833682b91ddea3a5d8721d6d64630faa946584e60c3259e51115f5fd721f0daf7742c0a9b149c9da9ac1a2909195f07b4be470c20b2c6
-
SSDEEP
1536:9dCccB9mqTccu2LehTLMlt8dlQCiBrYO8cLJTvYEghkzm6W:bCc0Y2qTLMlSq8OaEg96W
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-