General
-
Target
351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9
-
Size
438KB
-
Sample
221003-b63r5scfdn
-
MD5
748320cadf8f869f800f6968f437ad10
-
SHA1
4f5b597c61b6590ce19a3ecaa3c5e453d9493f40
-
SHA256
351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9
-
SHA512
d204064789d11221b1a3b8c392f8649828550a899d21835671940a218c0eb92977b2ed640f5b23f8de866aa204396e5c3405f7573e52461bdb4dc0514c11dc39
-
SSDEEP
6144:2ltrqAMqqjWybbQaw4nLyCkAEUL8xzG8bc3V/h6QOLZRqCyK32AO/Xo76INH:Ed1q6ybbQaw4Tur23hhnyRqCyg2d/4L
Behavioral task
behavioral1
Sample
351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://www.dantewa.com.au/logv/kele/gate.php
Targets
-
-
Target
351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9
-
Size
438KB
-
MD5
748320cadf8f869f800f6968f437ad10
-
SHA1
4f5b597c61b6590ce19a3ecaa3c5e453d9493f40
-
SHA256
351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9
-
SHA512
d204064789d11221b1a3b8c392f8649828550a899d21835671940a218c0eb92977b2ed640f5b23f8de866aa204396e5c3405f7573e52461bdb4dc0514c11dc39
-
SSDEEP
6144:2ltrqAMqqjWybbQaw4nLyCkAEUL8xzG8bc3V/h6QOLZRqCyK32AO/Xo76INH:Ed1q6ybbQaw4Tur23hhnyRqCyg2d/4L
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-