General
-
Target
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958
-
Size
152KB
-
Sample
221204-zgt1pshc9v
-
MD5
85fb1f5e2bce72ee1e704e1770467c03
-
SHA1
f35814f1b6699ac7935bad3cd9f2116e98b1db9f
-
SHA256
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958
-
SHA512
12082acc0cb5685d4c0f2254cca636d85fafb5951e6026c4a0538986094e5f6a45291693e14116dcabb17468d19757602a1b4fe3dbef4600ab26acbbb44d0b82
-
SSDEEP
3072:vsM+xYtQ9CIcDO4ZTGv1RRy93nRd93eFTzZeSWijRN3CtGJ:ZRwCPO4ZTUAVVCzQdi9N3C
Behavioral task
behavioral1
Sample
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://66.55.89.149:8080/forum/viewtopic.php
http://66.55.89.150:8080/forum/viewtopic.php
-
payload_url
http://cikonungunlugu.com/CMw.exe
http://ftp.lastraautosport.com.ar/xjH.exe
Targets
-
-
Target
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958
-
Size
152KB
-
MD5
85fb1f5e2bce72ee1e704e1770467c03
-
SHA1
f35814f1b6699ac7935bad3cd9f2116e98b1db9f
-
SHA256
afd51fd837d446417a07bb3e2990a18bf89bd21ec6959e6845a2bff699c4e958
-
SHA512
12082acc0cb5685d4c0f2254cca636d85fafb5951e6026c4a0538986094e5f6a45291693e14116dcabb17468d19757602a1b4fe3dbef4600ab26acbbb44d0b82
-
SSDEEP
3072:vsM+xYtQ9CIcDO4ZTGv1RRy93nRd93eFTzZeSWijRN3CtGJ:ZRwCPO4ZTUAVVCzQdi9N3C
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-