General
-
Target
29388fe3d11fe7b03e5a52bfeae8a77558ab901149140c6e28a04f2c44bdfcf8
-
Size
204KB
-
Sample
221126-kr6pxsfd43
-
MD5
0f957a264a82ec6e275def7b38bd80f9
-
SHA1
2073b738f80573f0796d5d591c00983e05ba0940
-
SHA256
29388fe3d11fe7b03e5a52bfeae8a77558ab901149140c6e28a04f2c44bdfcf8
-
SHA512
706834a86872259c43695f8445a063fe8b2a72e094c826ba5648ca5b26c40462bd0c756686a4746c8cf19268505a25bfb7f47a3ead00a69e08308a2aae5f2ec7
-
SSDEEP
3072:66WgE6TQkriqLQq+DIZQbQysVGj+8yygsdrCy52VFwdL4KlpKRcgv:6p6rByZS5orwN
Static task
static1
Behavioral task
behavioral1
Sample
29388fe3d11fe7b03e5a52bfeae8a77558ab901149140c6e28a04f2c44bdfcf8.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://ramzey.net/kilo/gate.php
Targets
-
-
Target
29388fe3d11fe7b03e5a52bfeae8a77558ab901149140c6e28a04f2c44bdfcf8
-
Size
204KB
-
MD5
0f957a264a82ec6e275def7b38bd80f9
-
SHA1
2073b738f80573f0796d5d591c00983e05ba0940
-
SHA256
29388fe3d11fe7b03e5a52bfeae8a77558ab901149140c6e28a04f2c44bdfcf8
-
SHA512
706834a86872259c43695f8445a063fe8b2a72e094c826ba5648ca5b26c40462bd0c756686a4746c8cf19268505a25bfb7f47a3ead00a69e08308a2aae5f2ec7
-
SSDEEP
3072:66WgE6TQkriqLQq+DIZQbQysVGj+8yygsdrCy52VFwdL4KlpKRcgv:6p6rByZS5orwN
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-