General
-
Target
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929
-
Size
147KB
-
Sample
221201-d953sabe45
-
MD5
718caf2f0f8f4c0962d95a7b78fbcb9f
-
SHA1
56c00323ab39a3fd73f36715aa967b0ea99cd970
-
SHA256
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929
-
SHA512
a44ba5bfa8a1da1d85753fa465de422160fd43065c0cf35e7ecb769ec10486be2cf4c8771b33470c2b23a2fa13d679a30638e8d67ff64af60c79ffc8201ab3b2
-
SSDEEP
3072:bzxiBaeYkJTD0Tv05Cf4EmZlAckdCAqacExhnLsVHruGE:h6DbG4TlxkdVtLstE
Behavioral task
behavioral1
Sample
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://66.55.89.148:8080/forum/viewtopic.php
http://66.55.89.149:8080/forum/viewtopic.php
-
payload_url
http://www.komzedo.com.ba/oEj.exe
http://agradealuminium.com.au/JiKi.exe
http://elektrabukacek.cz/hs9HBpbT.exe
Targets
-
-
Target
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929
-
Size
147KB
-
MD5
718caf2f0f8f4c0962d95a7b78fbcb9f
-
SHA1
56c00323ab39a3fd73f36715aa967b0ea99cd970
-
SHA256
68236459d34eab19e739058a93898d9ffbc68fe926fa9a86fdd3d487d7e13929
-
SHA512
a44ba5bfa8a1da1d85753fa465de422160fd43065c0cf35e7ecb769ec10486be2cf4c8771b33470c2b23a2fa13d679a30638e8d67ff64af60c79ffc8201ab3b2
-
SSDEEP
3072:bzxiBaeYkJTD0Tv05Cf4EmZlAckdCAqacExhnLsVHruGE:h6DbG4TlxkdVtLstE
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-