General
-
Target
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d
-
Size
549KB
-
Sample
221125-z5dcvsaf4x
-
MD5
6b50e5b32b3937cbb107825a144f7bc8
-
SHA1
492171452790445697106f1e8463cf74f8fc8b62
-
SHA256
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d
-
SHA512
8fe177ec002f63fce2ebb24c1292a3b810207b022f9fb42f310a625b2d7fc6bfb5360ad9dd1e06eb881a025e8f929682b3942fab2c80cd1c347abc808f8aba04
-
SSDEEP
12288:8ooGf9Y1Jop3A3IoCoj7+vjQxfibQQwwo:B+wp31Xoj79Kbbwj
Static task
static1
Behavioral task
behavioral1
Sample
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://www.indianmoneybag.in/wordpress/wp-content/themes/twentyfourteen/css/php/gate.php
Targets
-
-
Target
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d
-
Size
549KB
-
MD5
6b50e5b32b3937cbb107825a144f7bc8
-
SHA1
492171452790445697106f1e8463cf74f8fc8b62
-
SHA256
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d
-
SHA512
8fe177ec002f63fce2ebb24c1292a3b810207b022f9fb42f310a625b2d7fc6bfb5360ad9dd1e06eb881a025e8f929682b3942fab2c80cd1c347abc808f8aba04
-
SSDEEP
12288:8ooGf9Y1Jop3A3IoCoj7+vjQxfibQQwwo:B+wp31Xoj79Kbbwj
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-