General
-
Target
1982ad41fbc152ca75aba9550d272ad8c8cadb89cb8e6e5fc78b346bba569c5e
-
Size
108KB
-
Sample
221120-lbfdgaah4z
-
MD5
33564024134a452e642f6e5e0221cab0
-
SHA1
8b7ce2ccad2f27c42f38df6542bc4f653fb81d89
-
SHA256
1982ad41fbc152ca75aba9550d272ad8c8cadb89cb8e6e5fc78b346bba569c5e
-
SHA512
a4731185d32095e60f9666cc9cd10e4b3c47783f1f09983a83909b80d433719ca73064ab36ae8a920ca3c4c9e9686ccf2eff69b08d5a092ff3efeccdb1294a4b
-
SSDEEP
3072:t5NrLBsq0qu4yHCWbzOu4lXis3y9gQB/p8vlVyh:t/rLGPqWnRgXiCy9g0/Gv8
Static task
static1
Behavioral task
behavioral1
Sample
1982ad41fbc152ca75aba9550d272ad8c8cadb89cb8e6e5fc78b346bba569c5e.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://godekela.pw:571/fix/update.php
http://voekazik.pw:571/fix/update.php
-
payload_url
http://hoedolla.pw:571/fix/update.exe
Targets
-
-
Target
1982ad41fbc152ca75aba9550d272ad8c8cadb89cb8e6e5fc78b346bba569c5e
-
Size
108KB
-
MD5
33564024134a452e642f6e5e0221cab0
-
SHA1
8b7ce2ccad2f27c42f38df6542bc4f653fb81d89
-
SHA256
1982ad41fbc152ca75aba9550d272ad8c8cadb89cb8e6e5fc78b346bba569c5e
-
SHA512
a4731185d32095e60f9666cc9cd10e4b3c47783f1f09983a83909b80d433719ca73064ab36ae8a920ca3c4c9e9686ccf2eff69b08d5a092ff3efeccdb1294a4b
-
SSDEEP
3072:t5NrLBsq0qu4yHCWbzOu4lXis3y9gQB/p8vlVyh:t/rLGPqWnRgXiCy9g0/Gv8
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-