General
-
Target
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8
-
Size
144KB
-
Sample
221205-c5wswahb94
-
MD5
d4064bf5bf3ffd598b5ebc43eccc6648
-
SHA1
8d8afab6e8834fa1fd47b00c8ac50413540afad5
-
SHA256
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8
-
SHA512
33002c16a460beeb987f3bc2e3a52523b3f602aa82996a309694f38d1caa56bb69e0f5f4600d90512983db26a6d313b0dcb4a7a1a4e4c0f0f98ae4db3f42f218
-
SSDEEP
3072:0jlKZelTDXHbSnCZYoB1rLAxgutQb0HdUyY6CpaJFsZLoYHY:4weljSn8YoLLVrbwzuaj2rH
Behavioral task
behavioral1
Sample
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
pony
http://74.53.97.66:8080/forum/viewtopic.php
http://74.53.97.67:8080/forum/viewtopic.php
-
payload_url
http://orion.obidigital.net/d09ZhGf.exe
http://ftp.lastraautosport.com.ar/xjH.exe
Targets
-
-
Target
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8
-
Size
144KB
-
MD5
d4064bf5bf3ffd598b5ebc43eccc6648
-
SHA1
8d8afab6e8834fa1fd47b00c8ac50413540afad5
-
SHA256
741e85a2699cbc7301b8f76e8acf587d9a4d8674c20a74969eae7796bd466fe8
-
SHA512
33002c16a460beeb987f3bc2e3a52523b3f602aa82996a309694f38d1caa56bb69e0f5f4600d90512983db26a6d313b0dcb4a7a1a4e4c0f0f98ae4db3f42f218
-
SSDEEP
3072:0jlKZelTDXHbSnCZYoB1rLAxgutQb0HdUyY6CpaJFsZLoYHY:4weljSn8YoLLVrbwzuaj2rH
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-