General
-
Target
30dc5932a6c7cec77968120cd12e851e10c94cd10e5d8b6420da2f135d51aec8
-
Size
494KB
-
Sample
221128-g53nmsgb91
-
MD5
8a35a0f0226c68a0c5cc678bda3e2a24
-
SHA1
38e954470e214e382ea60a14faada780735259a6
-
SHA256
30dc5932a6c7cec77968120cd12e851e10c94cd10e5d8b6420da2f135d51aec8
-
SHA512
5c3a79c7345a27f667b286dd5bafb52d0740ac63e5a4352fb29f84779d805fdb2a0599e022b2b8df5a62a1acccdf83990f92a8fc3bedec5ba14411b123702d26
-
SSDEEP
12288:4HJBmoL9ppxHu5DZMrTkc9S6ccBibCEFp:4p0ypY6cSWp
Static task
static1
Behavioral task
behavioral1
Sample
30dc5932a6c7cec77968120cd12e851e10c94cd10e5d8b6420da2f135d51aec8.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://91.220.163.21/pony2/gate.php
Targets
-
-
Target
30dc5932a6c7cec77968120cd12e851e10c94cd10e5d8b6420da2f135d51aec8
-
Size
494KB
-
MD5
8a35a0f0226c68a0c5cc678bda3e2a24
-
SHA1
38e954470e214e382ea60a14faada780735259a6
-
SHA256
30dc5932a6c7cec77968120cd12e851e10c94cd10e5d8b6420da2f135d51aec8
-
SHA512
5c3a79c7345a27f667b286dd5bafb52d0740ac63e5a4352fb29f84779d805fdb2a0599e022b2b8df5a62a1acccdf83990f92a8fc3bedec5ba14411b123702d26
-
SSDEEP
12288:4HJBmoL9ppxHu5DZMrTkc9S6ccBibCEFp:4p0ypY6cSWp
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-