General
-
Target
196dc109a644232e5ff29b6974218100d7d894971f7df08187b3e172c988934f
-
Size
333KB
-
Sample
221128-nklyqaee81
-
MD5
f96912972380e49d68b8fdd318252ae8
-
SHA1
d5847ec6af8c6f47180d14d8cea838abed9749fa
-
SHA256
196dc109a644232e5ff29b6974218100d7d894971f7df08187b3e172c988934f
-
SHA512
63713aa580b064e5552dcf3e76f3d2d7bdfb57686dabc3678b52d68c129039e264833227d4ae9bc50cc54296da4b03afa77d3ce854c18f2708a2130f9fc20606
-
SSDEEP
6144:ajXE2vQW9+s+wgAYMB41hfR3etVAVel31+OLec1XeaNgdOLxAh:GXEJ2+wjYMBC1AVA4ZbO6xAh
Static task
static1
Behavioral task
behavioral1
Sample
196dc109a644232e5ff29b6974218100d7d894971f7df08187b3e172c988934f.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://funnyinvoiceorg.com/gate.php
http://formaterdocstras.com/gate.php
-
payload_url
http://marketplaceaa.com/wp-content/plugins/cached_data/b1.exe
http://martinapeit.com.ar/wp-content/plugins/cached_data/b1.exe
http://matchstickstudios.co.uk/wp-content/plugins/cached_data/b1.exe
Targets
-
-
Target
196dc109a644232e5ff29b6974218100d7d894971f7df08187b3e172c988934f
-
Size
333KB
-
MD5
f96912972380e49d68b8fdd318252ae8
-
SHA1
d5847ec6af8c6f47180d14d8cea838abed9749fa
-
SHA256
196dc109a644232e5ff29b6974218100d7d894971f7df08187b3e172c988934f
-
SHA512
63713aa580b064e5552dcf3e76f3d2d7bdfb57686dabc3678b52d68c129039e264833227d4ae9bc50cc54296da4b03afa77d3ce854c18f2708a2130f9fc20606
-
SSDEEP
6144:ajXE2vQW9+s+wgAYMB41hfR3etVAVel31+OLec1XeaNgdOLxAh:GXEJ2+wjYMBC1AVA4ZbO6xAh
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-