General
-
Target
508e4952ded967aaa6cd5ea8664f479911b649882ba37bed58ae1ef7c6405b04
-
Size
606KB
-
Sample
221128-txvpaace81
-
MD5
bd8c4881a96458f7bbc9a6164743f645
-
SHA1
6a827120289d60ff4c90543d586c590c326b13cf
-
SHA256
508e4952ded967aaa6cd5ea8664f479911b649882ba37bed58ae1ef7c6405b04
-
SHA512
b717a2b9af46e9e46390ab1f33de2de7a67ff0f17a760c03f96bed8efabcb80eb4e3b52078ab65f9b0626eb1df02a33aa48c5b7cf1db1732a086be182762936f
-
SSDEEP
3072:ItjLKxbA3zrIL701RCawZowcNlnBfAHXto+CIhNHkyEhXD+PM5Su7EVnPGEHp7f+:ItjWxbczG4XMoxnBegIh69D9QVnuEN8F
Static task
static1
Behavioral task
behavioral1
Sample
508e4952ded967aaa6cd5ea8664f479911b649882ba37bed58ae1ef7c6405b04.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://mydocuments.net76.net/Panel/gate.php
Targets
-
-
Target
508e4952ded967aaa6cd5ea8664f479911b649882ba37bed58ae1ef7c6405b04
-
Size
606KB
-
MD5
bd8c4881a96458f7bbc9a6164743f645
-
SHA1
6a827120289d60ff4c90543d586c590c326b13cf
-
SHA256
508e4952ded967aaa6cd5ea8664f479911b649882ba37bed58ae1ef7c6405b04
-
SHA512
b717a2b9af46e9e46390ab1f33de2de7a67ff0f17a760c03f96bed8efabcb80eb4e3b52078ab65f9b0626eb1df02a33aa48c5b7cf1db1732a086be182762936f
-
SSDEEP
3072:ItjLKxbA3zrIL701RCawZowcNlnBfAHXto+CIhNHkyEhXD+PM5Su7EVnPGEHp7f+:ItjWxbczG4XMoxnBegIh69D9QVnuEN8F
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-