General
-
Target
10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585
-
Size
78KB
-
Sample
221120-lesg7sba5z
-
MD5
57d3a2f9d8a911eedc5d7a833782e55c
-
SHA1
5752469dcf41fe0cf9b4a96f5608c8b40f4a52a4
-
SHA256
10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585
-
SHA512
db3e489fbd69c4f1358418b617124e231b4af50bb4c003153422a48bc53bfec81589079710efb1ba0ad842d2f8d5adb0b45d74d2b05006f7c697928612f86043
-
SSDEEP
1536:e7I44meDR3VAwilSc6bm+8+k0FRpZ5V2ektonrUYvjJ:CL4meDR3m/lS1CKRpZfkt2rX1
Static task
static1
Behavioral task
behavioral1
Sample
10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://googleapis.com/gate.php
http://web-cdn-node.com/gate.php
http://fbstatic-a.akamaihd.net/gate.php
http://l.yimg.com/gate.php
http://simple-cdn-node.com/gate.php
http://nym1.ib.adnxs.com/gate.php
http://cloud13.browser.ovi.com/gate.php
http://web-cdn-node.com/1.exe?c=1
-
payload_url
http://web-cdn-node.com/6.exe
Targets
-
-
Target
10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585
-
Size
78KB
-
MD5
57d3a2f9d8a911eedc5d7a833782e55c
-
SHA1
5752469dcf41fe0cf9b4a96f5608c8b40f4a52a4
-
SHA256
10d5cc17e3a3b74d0ccb3633bbf257483e86daa806a3d466ad5016b5e97d7585
-
SHA512
db3e489fbd69c4f1358418b617124e231b4af50bb4c003153422a48bc53bfec81589079710efb1ba0ad842d2f8d5adb0b45d74d2b05006f7c697928612f86043
-
SSDEEP
1536:e7I44meDR3VAwilSc6bm+8+k0FRpZ5V2ektonrUYvjJ:CL4meDR3m/lS1CKRpZfkt2rX1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-