General
-
Target
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a
-
Size
1.2MB
-
Sample
221003-b9p1fsbbh6
-
MD5
6e6127f242f2b6dd28346965a30022f0
-
SHA1
7c295f623f7abb54b1588c6e3ce036ce6f587920
-
SHA256
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a
-
SHA512
8dd0c61cf493517e04a9407de880f7c402fd29ecdf634bc6bb40bc7a4c86e2e80a2005789126c16c42e1dd3d10bd64c2a123e0ee46844fb605704d09322e99b3
-
SSDEEP
24576:mTd+f+VDvWrfv0GhVsh80qTAtdSlqV5Cr0dQSBov5m:mZ+f6Wrfv08o8bBlG5SZSU5m
Static task
static1
Behavioral task
behavioral1
Sample
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://btint.net16.net/html/gate.php
Targets
-
-
Target
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a
-
Size
1.2MB
-
MD5
6e6127f242f2b6dd28346965a30022f0
-
SHA1
7c295f623f7abb54b1588c6e3ce036ce6f587920
-
SHA256
ff96a2db1a51db1e8865c2563ac0aaad370482e98b11c0330cfedba7fcbb7d8a
-
SHA512
8dd0c61cf493517e04a9407de880f7c402fd29ecdf634bc6bb40bc7a4c86e2e80a2005789126c16c42e1dd3d10bd64c2a123e0ee46844fb605704d09322e99b3
-
SSDEEP
24576:mTd+f+VDvWrfv0GhVsh80qTAtdSlqV5Cr0dQSBov5m:mZ+f6Wrfv08o8bBlG5SZSU5m
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-