General
-
Target
7842e5c03fd4bbaf2d02af70163c111a6db0fb03bf109f4a8496e65c08c85e42
-
Size
140KB
-
Sample
221125-jgn7fsbd87
-
MD5
713180880d896b14db6d3d0221d478df
-
SHA1
921d0a5020a4ffdb839f58086d00228c2cf46940
-
SHA256
7842e5c03fd4bbaf2d02af70163c111a6db0fb03bf109f4a8496e65c08c85e42
-
SHA512
75a2d0418e6cee61814967b8c019a2faddb78a48439d2ebf8cc8436a8305be5bb4eed471a16b59f1146260bfa08d34a2cb0a9bec83638fac213cbe118eccb148
-
SSDEEP
3072:qwVwRAWMMoD5PnyqdPKOmK5EarXXW0ibUSSdlBS:Lw+Wbuf8KyarXXW0aUSSdl
Static task
static1
Behavioral task
behavioral1
Sample
7842e5c03fd4bbaf2d02af70163c111a6db0fb03bf109f4a8496e65c08c85e42.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://soulflower.com.mx/ext/alibaba/gate.php
Targets
-
-
Target
7842e5c03fd4bbaf2d02af70163c111a6db0fb03bf109f4a8496e65c08c85e42
-
Size
140KB
-
MD5
713180880d896b14db6d3d0221d478df
-
SHA1
921d0a5020a4ffdb839f58086d00228c2cf46940
-
SHA256
7842e5c03fd4bbaf2d02af70163c111a6db0fb03bf109f4a8496e65c08c85e42
-
SHA512
75a2d0418e6cee61814967b8c019a2faddb78a48439d2ebf8cc8436a8305be5bb4eed471a16b59f1146260bfa08d34a2cb0a9bec83638fac213cbe118eccb148
-
SSDEEP
3072:qwVwRAWMMoD5PnyqdPKOmK5EarXXW0ibUSSdlBS:Lw+Wbuf8KyarXXW0aUSSdl
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-