General
-
Target
1015e903300a667fe8fa0da0908d5ad8d7e797d8737789addba3306bd018966e
-
Size
104KB
-
Sample
221125-z5hbtaff86
-
MD5
16971271e38d7feace13b16dc9916c8e
-
SHA1
cd3128c38e46fdbf8b2199133ae910fcccc48929
-
SHA256
1015e903300a667fe8fa0da0908d5ad8d7e797d8737789addba3306bd018966e
-
SHA512
2fd8ab309f56fc57e22a5ce7960415b2451f886adaf5640d55dbbd50d34e195d1e7ee29eb519523c79a22ef2c3728e0bc4e83528ab677344d88cfce32a747488
-
SSDEEP
1536:JHz1d6k/KtwRjOefyYK6xGSu1o+1FOlJQVwnwuOpCTtjJeHbRYYM5tngBd26l6:V1Uk/o7YCT1oJE3ATtIKYktge
Static task
static1
Behavioral task
behavioral1
Sample
1015e903300a667fe8fa0da0908d5ad8d7e797d8737789addba3306bd018966e.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://windevup.craym.eu/popo/gate.php
Targets
-
-
Target
1015e903300a667fe8fa0da0908d5ad8d7e797d8737789addba3306bd018966e
-
Size
104KB
-
MD5
16971271e38d7feace13b16dc9916c8e
-
SHA1
cd3128c38e46fdbf8b2199133ae910fcccc48929
-
SHA256
1015e903300a667fe8fa0da0908d5ad8d7e797d8737789addba3306bd018966e
-
SHA512
2fd8ab309f56fc57e22a5ce7960415b2451f886adaf5640d55dbbd50d34e195d1e7ee29eb519523c79a22ef2c3728e0bc4e83528ab677344d88cfce32a747488
-
SSDEEP
1536:JHz1d6k/KtwRjOefyYK6xGSu1o+1FOlJQVwnwuOpCTtjJeHbRYYM5tngBd26l6:V1Uk/o7YCT1oJE3ATtIKYktge
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-