General
-
Target
7da40b7a0053d1b040d98a3e9a14f8add25e02c69f25f304e81c11758538e0d0
-
Size
134KB
-
Sample
221201-c342gaga59
-
MD5
e3847928d61134e25827a6897dd9cefa
-
SHA1
3b7c69f96fa35156f1934e398ad1152397cec075
-
SHA256
7da40b7a0053d1b040d98a3e9a14f8add25e02c69f25f304e81c11758538e0d0
-
SHA512
c31a310830e5563c7d0f10cfaa837ba6c8fc9743192594d9fee882f30589822564005f26d269a3a1d8eff4eeb6c79b6fb7ab8967a5734aebbb1c658fd741f7a7
-
SSDEEP
3072:JAtEyIGwO1RjrsgdFKdlCFxU6mow6LkJCNOpqQ:uttwkssF3symeOcQ
Static task
static1
Behavioral task
behavioral1
Sample
7da40b7a0053d1b040d98a3e9a14f8add25e02c69f25f304e81c11758538e0d0.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://momus.com.tw:8080/pony/gate.php
http://69.194.194.119/pony/gate.php
-
payload_url
http://www.uniaotec.com.br/0Yoo6.exe
http://216.119.80.138/KY5.exe
http://ftp.videoheretic.com/vFs6cZZ.exe
Targets
-
-
Target
7da40b7a0053d1b040d98a3e9a14f8add25e02c69f25f304e81c11758538e0d0
-
Size
134KB
-
MD5
e3847928d61134e25827a6897dd9cefa
-
SHA1
3b7c69f96fa35156f1934e398ad1152397cec075
-
SHA256
7da40b7a0053d1b040d98a3e9a14f8add25e02c69f25f304e81c11758538e0d0
-
SHA512
c31a310830e5563c7d0f10cfaa837ba6c8fc9743192594d9fee882f30589822564005f26d269a3a1d8eff4eeb6c79b6fb7ab8967a5734aebbb1c658fd741f7a7
-
SSDEEP
3072:JAtEyIGwO1RjrsgdFKdlCFxU6mow6LkJCNOpqQ:uttwkssF3symeOcQ
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-