General
-
Target
d650e12ea3bb05457a6f4780c13c3797510c53db21aecc71a036a1b073d7ec9f
-
Size
400KB
-
Sample
221128-nkkewsad53
-
MD5
c1bfbfe0db4a74611e32cc7f49cc9383
-
SHA1
38f1c558c6c8caefa3bb27fed5b7131c6786ce91
-
SHA256
d650e12ea3bb05457a6f4780c13c3797510c53db21aecc71a036a1b073d7ec9f
-
SHA512
d36bde7d7060b664bf7e281f4b86c43e400722a19bb4d893a8f7530a64a727e425e20c2c8180e586f3ea7f910def743378f02054e6a9cb56ee5f9e0f80647db9
-
SSDEEP
6144:EAizB2MpKOlNCOSgV6WFWraOgI+wtxV6bbPCEn6TcBeK:vizB2MpKObCVgV6WFWr2IhtQ7Vuc3
Static task
static1
Behavioral task
behavioral1
Sample
d650e12ea3bb05457a6f4780c13c3797510c53db21aecc71a036a1b073d7ec9f.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://manydocsfastrack.com/gate.php
http://invoiceformater.com/gate.php
http://doclibrarymk.com/gate.php
-
payload_url
http://en.beyoglugida.com/wp-content/plugins/cached_data/n1.exe
http://encentivhealth.com/wp-content/plugins/cached_data/n1.exe
http://en.inbar-solar.com/wp-content/plugins/cached_data/n1.exe
http://en.kotmed.com/wp-content/plugins/cached_data/n1.exe
http://essera.com/wp-content/plugins/cached_data/n1.exe
http://etc-coop.com/wp-content/plugins/cached_data/n1.exe
http://etc-ops.com/wp-content/plugins/cached_data/n1.exe
http://everylifecoach.org/wp-content/plugins/cached_data/n1.exe
Targets
-
-
Target
d650e12ea3bb05457a6f4780c13c3797510c53db21aecc71a036a1b073d7ec9f
-
Size
400KB
-
MD5
c1bfbfe0db4a74611e32cc7f49cc9383
-
SHA1
38f1c558c6c8caefa3bb27fed5b7131c6786ce91
-
SHA256
d650e12ea3bb05457a6f4780c13c3797510c53db21aecc71a036a1b073d7ec9f
-
SHA512
d36bde7d7060b664bf7e281f4b86c43e400722a19bb4d893a8f7530a64a727e425e20c2c8180e586f3ea7f910def743378f02054e6a9cb56ee5f9e0f80647db9
-
SSDEEP
6144:EAizB2MpKOlNCOSgV6WFWraOgI+wtxV6bbPCEn6TcBeK:vizB2MpKObCVgV6WFWr2IhtQ7Vuc3
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-