General
-
Target
32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56
-
Size
116KB
-
Sample
221127-rq8lfshd2z
-
MD5
182ecde7cce330542e2d662e5e7b2e1c
-
SHA1
cace25d3440230aec03adebf832ac428f780e5b6
-
SHA256
32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56
-
SHA512
17c1b288a23fc87f60119d3b36a27114edfe031fed6dc604a01d1d7206fd49382a32a0a84146ae59e8b6e652a1622a06ec141ad0439639b58634892ae5494618
-
SSDEEP
3072:RxZC5IJc19PKDg2mLXSBMOVex056lMu1+xkMu1+:1QJuQmBnClMu1+iMu1+
Static task
static1
Behavioral task
behavioral1
Sample
32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://transoceanoll.com/bl/gate.php
Targets
-
-
Target
32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56
-
Size
116KB
-
MD5
182ecde7cce330542e2d662e5e7b2e1c
-
SHA1
cace25d3440230aec03adebf832ac428f780e5b6
-
SHA256
32046fd24a2ffb86c85dcf0627d6a20e738793813353cfa0a9c4a0c7ba2e1e56
-
SHA512
17c1b288a23fc87f60119d3b36a27114edfe031fed6dc604a01d1d7206fd49382a32a0a84146ae59e8b6e652a1622a06ec141ad0439639b58634892ae5494618
-
SSDEEP
3072:RxZC5IJc19PKDg2mLXSBMOVex056lMu1+xkMu1+:1QJuQmBnClMu1+iMu1+
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-