General
-
Target
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4
-
Size
508KB
-
Sample
221127-rzrz3ahh8t
-
MD5
509a25dc903f92beb9f7bb1c840f3ddf
-
SHA1
7d8d840abfacbc92957a5c2077d75a19d804b514
-
SHA256
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4
-
SHA512
4e7a7b793dd4bbe2272150f1baa5e35fe6761bfdefc23943aabfe2494d36072381502ffeb7ee415179b69e6f5d04149d7e8f6558c079963f9bcd6de5bfb0a193
-
SSDEEP
12288:hhqngzYSbaNWzP7JixYE6ERV+7EMd5U5opbQpPP:jqngzYSbaNWTJixJ6ERY7EMd5U5opKPP
Static task
static1
Behavioral task
behavioral1
Sample
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
pony
http://holytrinitybless.in/ponns/gate.php
Targets
-
-
Target
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4
-
Size
508KB
-
MD5
509a25dc903f92beb9f7bb1c840f3ddf
-
SHA1
7d8d840abfacbc92957a5c2077d75a19d804b514
-
SHA256
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4
-
SHA512
4e7a7b793dd4bbe2272150f1baa5e35fe6761bfdefc23943aabfe2494d36072381502ffeb7ee415179b69e6f5d04149d7e8f6558c079963f9bcd6de5bfb0a193
-
SSDEEP
12288:hhqngzYSbaNWzP7JixYE6ERV+7EMd5U5opbQpPP:jqngzYSbaNWTJixJ6ERY7EMd5U5opKPP
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-