General
-
Target
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
Size
90KB
-
Sample
221127-m4sd6sca35
-
MD5
665a2160ac3de2fc83412a788f6055ed
-
SHA1
ddbc1f8a6b57141b3bc33cc31f3ab04a320e6d12
-
SHA256
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
SHA512
e328669a38b7d83dcc47a25abfcf49083b1d86808b5d8f0bb80aa3728cb0c151265a917e6ff78c5f3b7be1ea869ea58f18c51ada018d62fb80459796c36a6720
-
SSDEEP
1536:1eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEAxkzmFS:MCZ4GfOQtP/2XNpOs+djOS2EAtFS
Behavioral task
behavioral1
Sample
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://login1.ministryofvapes.com/Panel/gate.php
-
payload_url
http://login1.ministryofvapes.com/Panel/Pony.exe
Targets
-
-
Target
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
Size
90KB
-
MD5
665a2160ac3de2fc83412a788f6055ed
-
SHA1
ddbc1f8a6b57141b3bc33cc31f3ab04a320e6d12
-
SHA256
a6db28c525f34ab34ef8eb02c2edb12899a7e5ff6db40c79407563811216ae87
-
SHA512
e328669a38b7d83dcc47a25abfcf49083b1d86808b5d8f0bb80aa3728cb0c151265a917e6ff78c5f3b7be1ea869ea58f18c51ada018d62fb80459796c36a6720
-
SSDEEP
1536:1eCZ1HGGTqTQHDPOQtP/2XipupOpqaZf0S0HAcAOkACPZTvoEAxkzmFS:MCZ4GfOQtP/2XNpOs+djOS2EAtFS
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-