General
-
Target
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30
-
Size
500KB
-
Sample
221126-slq2aach85
-
MD5
2ac9e60e9e4770c8fcfb4c87a38bdc13
-
SHA1
0e7812057990cef7a6fe6b06037d0e54700d08bb
-
SHA256
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30
-
SHA512
c10b261725b291ed8aadfa80ba8302e8fd8c6ca2ccbf3702f650df9b44bc8626468f818cf099f5379042c2483ae629bca5a3a96a0f246181704afe9dceb2c718
-
SSDEEP
6144:hLPe67l7q1fcC3P2uYDEDEkBQGcxjgBSIEFDiKexjyFWnffPW:hbe6ZCcapYEDiWEF2KWVff+
Static task
static1
Behavioral task
behavioral1
Sample
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
pony
http://indianmoneybag.in/wp-content/themes/twentythirteen/obi/Panel/gate.php
Targets
-
-
Target
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30
-
Size
500KB
-
MD5
2ac9e60e9e4770c8fcfb4c87a38bdc13
-
SHA1
0e7812057990cef7a6fe6b06037d0e54700d08bb
-
SHA256
a980c417bb69ab4ad13eb5792293b368619983e3d6688aefa38f1d7009b8cd30
-
SHA512
c10b261725b291ed8aadfa80ba8302e8fd8c6ca2ccbf3702f650df9b44bc8626468f818cf099f5379042c2483ae629bca5a3a96a0f246181704afe9dceb2c718
-
SSDEEP
6144:hLPe67l7q1fcC3P2uYDEDEkBQGcxjgBSIEFDiKexjyFWnffPW:hbe6ZCcapYEDiWEF2KWVff+
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-