General
-
Target
027ef34c06440e1b92b92e5782fe7577ac4882a55052e5466530474cb0cc67f9
-
Size
90KB
-
Sample
221126-fgqthagc4v
-
MD5
9f6e3d49eedd9500f164fc1db5beb600
-
SHA1
7ee7855c1114b78097f41f37301af35755e71b77
-
SHA256
027ef34c06440e1b92b92e5782fe7577ac4882a55052e5466530474cb0cc67f9
-
SHA512
ee3b23dee17bacad3e0bd504ca0cbf728a360934e8a9183a319092855109bfd5812da2cabc6472c13641fd97caadae775dee24def6ad0f7efccc27808b5e0aa3
-
SSDEEP
1536:8dCiWXJ2kRHqTwqyg5klJQMzcNDxLj2ZwJt4uNfSO8/hz1YTvIEQkkzm2h:ACiI26lmfNDVSG3sOCDEQo2h
Behavioral task
behavioral1
Sample
027ef34c06440e1b92b92e5782fe7577ac4882a55052e5466530474cb0cc67f9.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://az.jlskincare.com/Panel/gate.php
-
payload_url
http://az.jlskincare.com/Panel/Pony.exe
Targets
-
-
Target
027ef34c06440e1b92b92e5782fe7577ac4882a55052e5466530474cb0cc67f9
-
Size
90KB
-
MD5
9f6e3d49eedd9500f164fc1db5beb600
-
SHA1
7ee7855c1114b78097f41f37301af35755e71b77
-
SHA256
027ef34c06440e1b92b92e5782fe7577ac4882a55052e5466530474cb0cc67f9
-
SHA512
ee3b23dee17bacad3e0bd504ca0cbf728a360934e8a9183a319092855109bfd5812da2cabc6472c13641fd97caadae775dee24def6ad0f7efccc27808b5e0aa3
-
SSDEEP
1536:8dCiWXJ2kRHqTwqyg5klJQMzcNDxLj2ZwJt4uNfSO8/hz1YTvIEQkkzm2h:ACiI26lmfNDVSG3sOCDEQo2h
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-