General
-
Target
4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461.exe
-
Size
74KB
-
Sample
220521-yhyvlsdac9
-
MD5
0829a42258ef1ec6d9abb92d53aa230f
-
SHA1
2f285a08daeb710f383e6f8883946c2daac930f4
-
SHA256
4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461
-
SHA512
087227a3ec44ad50ff428f2b4037b746d199c0b250a2d6ddcf9027cd27a03bf6f3f00add11c59b681f62096b5555ac2e47aa41459b23a3ad89acc00bb22774b6
Static task
static1
Behavioral task
behavioral1
Sample
4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://www.abogadosiriarte.com/resp.php
http://www.azucarnatural.com/resp.php
Targets
-
-
Target
4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461.exe
-
Size
74KB
-
MD5
0829a42258ef1ec6d9abb92d53aa230f
-
SHA1
2f285a08daeb710f383e6f8883946c2daac930f4
-
SHA256
4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461
-
SHA512
087227a3ec44ad50ff428f2b4037b746d199c0b250a2d6ddcf9027cd27a03bf6f3f00add11c59b681f62096b5555ac2e47aa41459b23a3ad89acc00bb22774b6
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-