General
-
Target
6d537ffc73ac0547f921afe97f77c4d184d6cde1ebbe85230c6a96f6d1a76767
-
Size
1.5MB
-
Sample
221125-z4v7aaff34
-
MD5
352f73f62cb9bea241c4aeae5b90438c
-
SHA1
19e5eeceec9cdba5c418124cc997ca748b1185d1
-
SHA256
6d537ffc73ac0547f921afe97f77c4d184d6cde1ebbe85230c6a96f6d1a76767
-
SHA512
ddecf9b3ee840e8f94147e559319f54a4a73fd9b76afa8e2f3c628b0470ea62b628f8616b7c076ebaf0562ebcd1f085f4d90548e10a9f09050bbc4e951081853
-
SSDEEP
24576:/fTn16id9LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQ:/fB6idpZmQyaJ1ZmFcqi+SRAG+
Static task
static1
Behavioral task
behavioral1
Sample
6d537ffc73ac0547f921afe97f77c4d184d6cde1ebbe85230c6a96f6d1a76767.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://www.estateboulv.com/html/nza/html/gate.php
Targets
-
-
Target
6d537ffc73ac0547f921afe97f77c4d184d6cde1ebbe85230c6a96f6d1a76767
-
Size
1.5MB
-
MD5
352f73f62cb9bea241c4aeae5b90438c
-
SHA1
19e5eeceec9cdba5c418124cc997ca748b1185d1
-
SHA256
6d537ffc73ac0547f921afe97f77c4d184d6cde1ebbe85230c6a96f6d1a76767
-
SHA512
ddecf9b3ee840e8f94147e559319f54a4a73fd9b76afa8e2f3c628b0470ea62b628f8616b7c076ebaf0562ebcd1f085f4d90548e10a9f09050bbc4e951081853
-
SSDEEP
24576:/fTn16id9LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQ:/fB6idpZmQyaJ1ZmFcqi+SRAG+
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-