General
-
Target
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1
-
Size
143KB
-
Sample
221203-epwjaada69
-
MD5
7596a196d185b4423a6981eb9c684430
-
SHA1
e77a1b2461ddf6f32152344ec1644f1fee90dfc8
-
SHA256
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1
-
SHA512
ecd34046f8400b5b009130ce79b24781aa5b5693e6694ae6c656541366f463d26ed985890753193c632dc55c53aa6fe72006c3627e719378689d8e7f03df14e7
-
SSDEEP
3072:XjlKZelTDZfra36ZbYNgLV3XJBbKuMHiJOpaJtK0rvox2qUQ:Jwelpa3UbYuFPbUPatrE
Behavioral task
behavioral1
Sample
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://66.55.89.150:8080/forum/viewtopic.php
http://66.55.89.151:8080/forum/viewtopic.php
-
payload_url
http://www.impresabonincontro.it/5vEv8Q.exe
http://ftp.groar.com.br/KUTS0Kc.exe
http://www.astrologiamilano.it/R8sY.exe
Targets
-
-
Target
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1
-
Size
143KB
-
MD5
7596a196d185b4423a6981eb9c684430
-
SHA1
e77a1b2461ddf6f32152344ec1644f1fee90dfc8
-
SHA256
abcaac02d6aaa4bf654df6ccc29e10cd58b3168bdd94b521484926e1b7390aa1
-
SHA512
ecd34046f8400b5b009130ce79b24781aa5b5693e6694ae6c656541366f463d26ed985890753193c632dc55c53aa6fe72006c3627e719378689d8e7f03df14e7
-
SSDEEP
3072:XjlKZelTDZfra36ZbYNgLV3XJBbKuMHiJOpaJtK0rvox2qUQ:Jwelpa3UbYuFPbUPatrE
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-