General
-
Target
ee993358795ea024fa23c10851de4dadeff613bb46504d1afcb8fd1a796a1155
-
Size
237KB
-
Sample
221127-rzttnaeb86
-
MD5
dbf4b44fa6dac71f8522d05ab35d8a63
-
SHA1
99e0a481c533e0e06551f233a2b33206044e5581
-
SHA256
ee993358795ea024fa23c10851de4dadeff613bb46504d1afcb8fd1a796a1155
-
SHA512
3c047a4c749a7873476ae9017f2539c6030c5484de6317c75af129634b133e16c72f7f0867f429d86b8ffba33948bedd36400926d88146c1da413ce5275b7160
-
SSDEEP
6144:w7L3Hrg8Nu29yNh4c3nrIWLDX7x6qWzcz1f6cXvs+:AL3fNv9BcXXL7tWQ1f6MJ
Static task
static1
Behavioral task
behavioral1
Sample
dhl.info-pdf.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://holytrinitybless.in/ponns/gate.php
Targets
-
-
Target
dhl.info-pdf.exe
-
Size
508KB
-
MD5
509a25dc903f92beb9f7bb1c840f3ddf
-
SHA1
7d8d840abfacbc92957a5c2077d75a19d804b514
-
SHA256
4b44485923a0654f507f37fd1184cd28a33ffdaa5e465e2f3f723960386ee2a4
-
SHA512
4e7a7b793dd4bbe2272150f1baa5e35fe6761bfdefc23943aabfe2494d36072381502ffeb7ee415179b69e6f5d04149d7e8f6558c079963f9bcd6de5bfb0a193
-
SSDEEP
12288:hhqngzYSbaNWzP7JixYE6ERV+7EMd5U5opbQpPP:jqngzYSbaNWTJixJ6ERY7EMd5U5opKPP
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-