General
-
Target
bf9ccb427ef169e4ab975f58575ae19517d34c2c0e07f048b3a5158fef8ebf6b
-
Size
90KB
-
Sample
221127-m4qkksca29
-
MD5
c50de2432cc25efda06f5248de941221
-
SHA1
50c2dd8b54e749aaaf727180f8964f6eb9268a47
-
SHA256
bf9ccb427ef169e4ab975f58575ae19517d34c2c0e07f048b3a5158fef8ebf6b
-
SHA512
4ab1d07adff1a7c3df7b1e1ad9ede9df7057093a1ce604c3c4c54c873c0f8826936d3f452afc165dfbbd11a53b2e41049c1532bdd32b236b19fbdebe5263cb2e
-
SSDEEP
1536:3eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEA2kzmFS:OCZ4GfOQtP/2XNpOs+djOS2EAmFS
Behavioral task
behavioral1
Sample
bf9ccb427ef169e4ab975f58575ae19517d34c2c0e07f048b3a5158fef8ebf6b.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://login2.ministryofvapes.com/Panel/gate.php
-
payload_url
http://login2.ministryofvapes.com/Panel/Pony.exe
Targets
-
-
Target
bf9ccb427ef169e4ab975f58575ae19517d34c2c0e07f048b3a5158fef8ebf6b
-
Size
90KB
-
MD5
c50de2432cc25efda06f5248de941221
-
SHA1
50c2dd8b54e749aaaf727180f8964f6eb9268a47
-
SHA256
bf9ccb427ef169e4ab975f58575ae19517d34c2c0e07f048b3a5158fef8ebf6b
-
SHA512
4ab1d07adff1a7c3df7b1e1ad9ede9df7057093a1ce604c3c4c54c873c0f8826936d3f452afc165dfbbd11a53b2e41049c1532bdd32b236b19fbdebe5263cb2e
-
SSDEEP
1536:3eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEA2kzmFS:OCZ4GfOQtP/2XNpOs+djOS2EAmFS
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-