General
-
Target
b10761090fb65585e4a92018117f216bbd0cf2fa21b6abc53cfdbe06e5d3ecbe
-
Size
35KB
-
Sample
221128-e4h7haag41
-
MD5
9c597081f9cc632264851fc6d248eebf
-
SHA1
154130c8400bc153bc6f296a8c76d8be2837f73c
-
SHA256
b10761090fb65585e4a92018117f216bbd0cf2fa21b6abc53cfdbe06e5d3ecbe
-
SHA512
580440f7aa2801ef99f2153c1e922ac95a8d08be80652a6dddbe6c1a2b5bcabe48258ea8cfa47e521f9febe8edd8607d52fceb8e971f8a8d7eecfa1962c95c43
-
SSDEEP
768:AHhOf+bmCaCZKiAoOxTQB7YL14SILfLsl0FnbcuyD7UT:AeCZKiHETQZ3DLsWFnouy8T
Behavioral task
behavioral1
Sample
b10761090fb65585e4a92018117f216bbd0cf2fa21b6abc53cfdbe06e5d3ecbe.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://youngworldplc.com/pakins/gate.php
-
payload_url
http://youngworldplc.com/pakins/file.exe
Targets
-
-
Target
b10761090fb65585e4a92018117f216bbd0cf2fa21b6abc53cfdbe06e5d3ecbe
-
Size
35KB
-
MD5
9c597081f9cc632264851fc6d248eebf
-
SHA1
154130c8400bc153bc6f296a8c76d8be2837f73c
-
SHA256
b10761090fb65585e4a92018117f216bbd0cf2fa21b6abc53cfdbe06e5d3ecbe
-
SHA512
580440f7aa2801ef99f2153c1e922ac95a8d08be80652a6dddbe6c1a2b5bcabe48258ea8cfa47e521f9febe8edd8607d52fceb8e971f8a8d7eecfa1962c95c43
-
SSDEEP
768:AHhOf+bmCaCZKiAoOxTQB7YL14SILfLsl0FnbcuyD7UT:AeCZKiHETQZ3DLsWFnouy8T
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-