General
-
Target
pony.exe
-
Size
2.6MB
-
Sample
210721-g6ng2rk1kj
-
MD5
ae95ec88d9b9ff869181e6fe2c60ca6f
-
SHA1
0f24a43b088b64d19f1bce99e80f80108005ad02
-
SHA256
ab479389ce28fb6d30f6b6c60346aed6aba5d32b6a5c2e41cb8e7a640d4a5c91
-
SHA512
626a2702c0c9ddfcea1af665d80673520002b00f1a3c190709671c878e83d86b71b71d8e281fb21b49ec5a8847b677bbd157e6a8962e601ad183c6c4be4bc994
Static task
static1
Behavioral task
behavioral1
Sample
pony.exe
Resource
win7v20210410
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
pony.exe
-
Size
2.6MB
-
MD5
ae95ec88d9b9ff869181e6fe2c60ca6f
-
SHA1
0f24a43b088b64d19f1bce99e80f80108005ad02
-
SHA256
ab479389ce28fb6d30f6b6c60346aed6aba5d32b6a5c2e41cb8e7a640d4a5c91
-
SHA512
626a2702c0c9ddfcea1af665d80673520002b00f1a3c190709671c878e83d86b71b71d8e281fb21b49ec5a8847b677bbd157e6a8962e601ad183c6c4be4bc994
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-