General
-
Target
9ea6bea66ef05211c0aced22a30a85405c9e27561a69c5c657cfac5d9983ecb5
-
Size
407KB
-
Sample
221127-qb442sdf7w
-
MD5
4ed1786f75251376f23bc0df2cd98fff
-
SHA1
80dc7d9f2e9130e7b63c264aedb696fa3f9802b5
-
SHA256
9ea6bea66ef05211c0aced22a30a85405c9e27561a69c5c657cfac5d9983ecb5
-
SHA512
f4eb4cddddbe2591cc007e43c1f43a4b90ef98ce3a18087b342588c98fcb6bea064e8472b5128e8ca28fb3ed01f567025168749bcd637c09db37a9a65df48f3a
-
SSDEEP
12288:bnuwXLAdxPjSLNSmyXZ6Y97Xrj8Sn6Gd4L/O:qwX+xus5lXsS6GGL
Static task
static1
Behavioral task
behavioral1
Sample
9ea6bea66ef05211c0aced22a30a85405c9e27561a69c5c657cfac5d9983ecb5.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://mystoredoc.com/gate.php
http://sestoreinv.com/gate.php
http://menstoreins.com/gate.php
-
payload_url
http://cukierniacapri.pl/wp-content/plugins/cached_data/m1.exe
http://cyctechnology.com/wp-content/plugins/cached_data/m1.exe
http://curatedayton.com/wp-content/plugins/cached_data/m1.exe
Targets
-
-
Target
9ea6bea66ef05211c0aced22a30a85405c9e27561a69c5c657cfac5d9983ecb5
-
Size
407KB
-
MD5
4ed1786f75251376f23bc0df2cd98fff
-
SHA1
80dc7d9f2e9130e7b63c264aedb696fa3f9802b5
-
SHA256
9ea6bea66ef05211c0aced22a30a85405c9e27561a69c5c657cfac5d9983ecb5
-
SHA512
f4eb4cddddbe2591cc007e43c1f43a4b90ef98ce3a18087b342588c98fcb6bea064e8472b5128e8ca28fb3ed01f567025168749bcd637c09db37a9a65df48f3a
-
SSDEEP
12288:bnuwXLAdxPjSLNSmyXZ6Y97Xrj8Sn6Gd4L/O:qwX+xus5lXsS6GGL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-