General
-
Target
2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed.exe
-
Size
84KB
-
Sample
220514-q5lvkaaac9
-
MD5
009aef3fc495cd2f1ebb6789f7009e4e
-
SHA1
64c633e0af7ae1e313a15a33ac470aa5baa44ad7
-
SHA256
2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed
-
SHA512
a173038fb17aab61e5f8be7e72b6e4bbce38f65c344af0e4212d0e60f6b49d9ce10dc8e1547a5ce5d3a365de45d96e8166c02b10a616462930435d75387dae23
Static task
static1
Behavioral task
behavioral1
Sample
2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://caitymccardell.com/wp-content/upd.php
http://childrensranchpdc.com/wp-content/upd.php
http://teach4god.com/blog/wp-content/upd.php
-
payload_url
http://bealkalinenow.com/wp-content/fe/1.exe
http://bealkalinenow.com/wp-content/fe/2.exe
http://bealkalinenow.com/wp-content/fe/3.exe
Targets
-
-
Target
2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed.exe
-
Size
84KB
-
MD5
009aef3fc495cd2f1ebb6789f7009e4e
-
SHA1
64c633e0af7ae1e313a15a33ac470aa5baa44ad7
-
SHA256
2685d9e98f6a0216c28a3bc17b21849580fc37f9b351abdd9cf9aab57a6df1ed
-
SHA512
a173038fb17aab61e5f8be7e72b6e4bbce38f65c344af0e4212d0e60f6b49d9ce10dc8e1547a5ce5d3a365de45d96e8166c02b10a616462930435d75387dae23
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-