General
-
Target
68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e.exe
-
Size
88KB
-
Sample
220521-yhz3nsgcck
-
MD5
62c766ff6525a05483e9b8ec2f13c050
-
SHA1
40485d4229762a03b7fca40c8f82d04884936363
-
SHA256
68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e
-
SHA512
2112193833c7582223a0bcd9a0e083c4af75ce4a934e80b3c8afc0d0e0b8034f9df08ab6a0b7a2acc8b23155ef2daaae106a7d50187b2f99ac1825e7903721cf
Static task
static1
Behavioral task
behavioral1
Sample
68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://bmzblog.com/default.php?5L6PGBkdZacy8NWlzc1iWwvafZxYtWw7ufhfL9Ne
http://brooklynpremium.com/default.php?Hl6C3s7pmemdZRosz4eAt6FkCO58Bolr
http://klamicro.com/default.php?CyXuiDAcp21uPrfbAuv6hkCmHUVRTwhjGBZTGMB
http://install-cap.com.mx/default.php?HuIRSkboVeo37JtK7C1gLiUZAFhjy71Gk
http://globalpaytech.com/default.php?iPPCgIdQ25LKPoiBniZiQ8MYAWJT7NfZlj
Targets
-
-
Target
68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e.exe
-
Size
88KB
-
MD5
62c766ff6525a05483e9b8ec2f13c050
-
SHA1
40485d4229762a03b7fca40c8f82d04884936363
-
SHA256
68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e
-
SHA512
2112193833c7582223a0bcd9a0e083c4af75ce4a934e80b3c8afc0d0e0b8034f9df08ab6a0b7a2acc8b23155ef2daaae106a7d50187b2f99ac1825e7903721cf
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
-
suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
suricata: ET MALWARE Win32.Fareit.A/Pony Downloader Checkin
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-