General
-
Target
388baa935d76d20beb04d64d79c74162fa0a2fb609189e372949027303909dc5
-
Size
629KB
-
Sample
221126-k25wdafg76
-
MD5
0035c12c4c7def3191dbc034db922cff
-
SHA1
9b6735f4043ffcf98c709f95dadcd5ae4524a3d2
-
SHA256
388baa935d76d20beb04d64d79c74162fa0a2fb609189e372949027303909dc5
-
SHA512
d0af69fd5934a0bee7ac8f69174445f093911fd4373d4b959a34d8188256dbf3946b4a71fe1dae3cb9138b0560c1a882db5d178c6c02f010d7d6750d885690b2
-
SSDEEP
12288:nBMi9VftLvBKGZgtfySIUPskjAhdUU54KnmVII:nBMiqGKtfySzUkkw79
Static task
static1
Behavioral task
behavioral1
Sample
388baa935d76d20beb04d64d79c74162fa0a2fb609189e372949027303909dc5.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://vodkaparty.co.in/sakura/gate.php
-
payload_url
http://vodkaparty.co.in/sakura/shit.exe
Targets
-
-
Target
388baa935d76d20beb04d64d79c74162fa0a2fb609189e372949027303909dc5
-
Size
629KB
-
MD5
0035c12c4c7def3191dbc034db922cff
-
SHA1
9b6735f4043ffcf98c709f95dadcd5ae4524a3d2
-
SHA256
388baa935d76d20beb04d64d79c74162fa0a2fb609189e372949027303909dc5
-
SHA512
d0af69fd5934a0bee7ac8f69174445f093911fd4373d4b959a34d8188256dbf3946b4a71fe1dae3cb9138b0560c1a882db5d178c6c02f010d7d6750d885690b2
-
SSDEEP
12288:nBMi9VftLvBKGZgtfySIUPskjAhdUU54KnmVII:nBMiqGKtfySzUkkw79
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-