General
-
Target
54f387294e9a5b9e7a11ac9f2cfaad7a387d137a5f3304c6348db86ac2be820e
-
Size
264KB
-
Sample
221127-mphlesag36
-
MD5
3f22b8e1bb202ab40ad1e23bddf4c834
-
SHA1
016efda00f5446b60df788e666765004893238c6
-
SHA256
54f387294e9a5b9e7a11ac9f2cfaad7a387d137a5f3304c6348db86ac2be820e
-
SHA512
1cde2d359494bbe97892f84dca367993923af6e96b5b8d7327656473995e0f4cfd538932527c8a6afdb540baa7be027003d47d3895f3061066458dc0988a205a
-
SSDEEP
6144:XnU7UEbdUuDNQ2wcBePc0A0n3lfRwmaI0e6wHVKLqdzunf:XRE/e5cBoJlpkEWLq9un
Static task
static1
Behavioral task
behavioral1
Sample
54f387294e9a5b9e7a11ac9f2cfaad7a387d137a5f3304c6348db86ac2be820e.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://wireshark-download.sytes.net/pon/gate.php
Targets
-
-
Target
54f387294e9a5b9e7a11ac9f2cfaad7a387d137a5f3304c6348db86ac2be820e
-
Size
264KB
-
MD5
3f22b8e1bb202ab40ad1e23bddf4c834
-
SHA1
016efda00f5446b60df788e666765004893238c6
-
SHA256
54f387294e9a5b9e7a11ac9f2cfaad7a387d137a5f3304c6348db86ac2be820e
-
SHA512
1cde2d359494bbe97892f84dca367993923af6e96b5b8d7327656473995e0f4cfd538932527c8a6afdb540baa7be027003d47d3895f3061066458dc0988a205a
-
SSDEEP
6144:XnU7UEbdUuDNQ2wcBePc0A0n3lfRwmaI0e6wHVKLqdzunf:XRE/e5cBoJlpkEWLq9un
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-