General
-
Target
f70d673245f1bb61a50a1fa8b3a1c113370a98ca5e9ecfb699a27235afaf4fd2
-
Size
142KB
-
Sample
221120-ht941sca37
-
MD5
32d572a28fa1a4d53a22bb8ca30d7c8e
-
SHA1
82ced4463cc20e862fc830f5e5764df1eb11883e
-
SHA256
f70d673245f1bb61a50a1fa8b3a1c113370a98ca5e9ecfb699a27235afaf4fd2
-
SHA512
84bb674a4cd31ae4ed45e8269d99903513ebbb03d7bf4913b7c1eb576396b99a28d71030cf85b23397508e77cf524631e75fede3e29205636d220244c09c6123
-
SSDEEP
3072:794vF228Y8VPpvGTqlvUUvSEJvdq6twBAgiI6:weV5GTqJ1vSuvdq6twp7
Static task
static1
Behavioral task
behavioral1
Sample
f70d673245f1bb61a50a1fa8b3a1c113370a98ca5e9ecfb699a27235afaf4fd2.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://91.207.6.142:8080/forum/viewtopic.php
-
payload_url
http://ftp.msck.biz/NwGBiaW.exe
http://sousuoku.com/ehRqcK55.exe
http://www.fahrsicherheit-cardrive.de/ZGg.exe
Targets
-
-
Target
f70d673245f1bb61a50a1fa8b3a1c113370a98ca5e9ecfb699a27235afaf4fd2
-
Size
142KB
-
MD5
32d572a28fa1a4d53a22bb8ca30d7c8e
-
SHA1
82ced4463cc20e862fc830f5e5764df1eb11883e
-
SHA256
f70d673245f1bb61a50a1fa8b3a1c113370a98ca5e9ecfb699a27235afaf4fd2
-
SHA512
84bb674a4cd31ae4ed45e8269d99903513ebbb03d7bf4913b7c1eb576396b99a28d71030cf85b23397508e77cf524631e75fede3e29205636d220244c09c6123
-
SSDEEP
3072:794vF228Y8VPpvGTqlvUUvSEJvdq6twBAgiI6:weV5GTqJ1vSuvdq6twp7
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-