General
-
Target
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
-
Size
491KB
-
Sample
221126-aea3dagf23
-
MD5
ebd7aea5d363a032c19d3f58bfaaf802
-
SHA1
75555e23db0ffe361a4cc71522ea603bad8a5b42
-
SHA256
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
-
SHA512
d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
SSDEEP
3072:zaHqHL+1tc0ZioAX2uq5RhVYtfZ14sBEDErAgsafvWab4sBEDErAgsaf7:zaULim0ZUohVYtfZuBgs93Bgsy
Static task
static1
Behavioral task
behavioral1
Sample
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://185.7.34.251/~umord163/decpony/gate.php
Targets
-
-
Target
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
-
Size
491KB
-
MD5
ebd7aea5d363a032c19d3f58bfaaf802
-
SHA1
75555e23db0ffe361a4cc71522ea603bad8a5b42
-
SHA256
982a6575259d8d905007d22e464b4d59a72f4930aebfe7862b2840129641739e
-
SHA512
d1f184ac1e2e2e02e66232adc99b946b650a0ca53ce34fc91f76c3d0470879229c4ebb189e45514d2ad655b6e97680d677a6f608c9e6c840d0138c8256eb9ec1
-
SSDEEP
3072:zaHqHL+1tc0ZioAX2uq5RhVYtfZ14sBEDErAgsafvWab4sBEDErAgsaf7:zaULim0ZUohVYtfZuBgs93Bgsy
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-