General
-
Target
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577
-
Size
974KB
-
Sample
221127-mvag1abb84
-
MD5
d0548e1561373a96b4df12bb923f4f07
-
SHA1
1839603f7877d0a95b464fb70245590a04f7ce3a
-
SHA256
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577
-
SHA512
4d317548e3279ab58d7f807330e5683ae4c42b967caefd4cb77096f3f4ead6e176357689bfef124c0d6711b6eed3b8bf306766c5c16b0a185bf6d6a176ec7ebb
-
SSDEEP
24576:UI7NrWgHEE/7vJE1fUPV/vyU87Om/A8pgTF0aKJ9ZJmrtuN7Z:UI7NbHEEVhPVqU8qmHafGCad
Static task
static1
Behavioral task
behavioral1
Sample
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
pony
http://goodwellbeard.biz/wordpress/wp-includes/css/admin/panel/gate.php
Targets
-
-
Target
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577
-
Size
974KB
-
MD5
d0548e1561373a96b4df12bb923f4f07
-
SHA1
1839603f7877d0a95b464fb70245590a04f7ce3a
-
SHA256
42bd57db505948a83bad01393282eeb8e166aac551a89354fa05d579dc84e577
-
SHA512
4d317548e3279ab58d7f807330e5683ae4c42b967caefd4cb77096f3f4ead6e176357689bfef124c0d6711b6eed3b8bf306766c5c16b0a185bf6d6a176ec7ebb
-
SSDEEP
24576:UI7NrWgHEE/7vJE1fUPV/vyU87Om/A8pgTF0aKJ9ZJmrtuN7Z:UI7NbHEEVhPVqU8qmHafGCad
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-