General
-
Target
13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53
-
Size
113KB
-
Sample
221002-k6w42aabbj
-
MD5
4c7ab08d754009d3da33567beb21f536
-
SHA1
0cc800272ad9fc776c255bb4c1961e312c7e6912
-
SHA256
13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53
-
SHA512
f8fd41fc988007b5f398f2e4b7a2c4b92f8845a35a7db6379113a08a41e118252fde224c6cfae4d44264267a82c88aafe22f6ebf9611aefff093cc1d29e62707
-
SSDEEP
3072:Rd2KQcvvnqShZpr+mybhKbH34F1hqJSBy:s2nqSp+mcwbHIsgy
Static task
static1
Behavioral task
behavioral1
Sample
13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://82.146.37.129/ppp/ta.php
-
payload_url
http://82.146.39.221/p2p/1.exe
Targets
-
-
Target
13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53
-
Size
113KB
-
MD5
4c7ab08d754009d3da33567beb21f536
-
SHA1
0cc800272ad9fc776c255bb4c1961e312c7e6912
-
SHA256
13d8a46c7a85ea95c7f2c27cdc23b6486d77c5966ce7efe237757679a7e2fb53
-
SHA512
f8fd41fc988007b5f398f2e4b7a2c4b92f8845a35a7db6379113a08a41e118252fde224c6cfae4d44264267a82c88aafe22f6ebf9611aefff093cc1d29e62707
-
SSDEEP
3072:Rd2KQcvvnqShZpr+mybhKbH34F1hqJSBy:s2nqSp+mcwbHIsgy
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-