General
-
Target
85268034ce39f5c2b8375bdbae2d2497c19e0230fb7b205b17c9d3e6e26f1101.exe
-
Size
220KB
-
Sample
220521-yhzrxadad9
-
MD5
670bf579a6755235b43528cf6d161d8a
-
SHA1
acf624afea44683d0966f40a996e218baed69eff
-
SHA256
85268034ce39f5c2b8375bdbae2d2497c19e0230fb7b205b17c9d3e6e26f1101
-
SHA512
3022a845533286ab44c999db7272083aa33725ace7aea53c6b4569fb7d4e3b35db5936c76d02261112271e2827f54803152d2d8596e4bf41e04cecf9d945ae32
Static task
static1
Behavioral task
behavioral1
Sample
85268034ce39f5c2b8375bdbae2d2497c19e0230fb7b205b17c9d3e6e26f1101.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://saol.com/images/ola/panel/gate.php
Targets
-
-
Target
85268034ce39f5c2b8375bdbae2d2497c19e0230fb7b205b17c9d3e6e26f1101.exe
-
Size
220KB
-
MD5
670bf579a6755235b43528cf6d161d8a
-
SHA1
acf624afea44683d0966f40a996e218baed69eff
-
SHA256
85268034ce39f5c2b8375bdbae2d2497c19e0230fb7b205b17c9d3e6e26f1101
-
SHA512
3022a845533286ab44c999db7272083aa33725ace7aea53c6b4569fb7d4e3b35db5936c76d02261112271e2827f54803152d2d8596e4bf41e04cecf9d945ae32
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-