General
-
Target
fa5751c99e2ffee4d8ce6ec338029f9849fa576e58a945828359754d4de957c0
-
Size
80KB
-
Sample
221203-c2tt4sgb63
-
MD5
b1e656e698ca0f1c94e2fbd4184a610f
-
SHA1
3bc346e24e2e8569bed03f09c787b46cfaeb348b
-
SHA256
fa5751c99e2ffee4d8ce6ec338029f9849fa576e58a945828359754d4de957c0
-
SHA512
a007dc241aeed20ee64934a740184345cdcf89601c2cd8b3cf9258c8c609a8b82bacde324897b98028343c55ff15116432881936fbd408263e5685a358603b4e
-
SSDEEP
1536:xrAJCsyJr5Do0P1W/v3HbCegeRLQI4DsWSQ607i:CEnJt9Q3bCERsEWLd
Static task
static1
Behavioral task
behavioral1
Sample
fa5751c99e2ffee4d8ce6ec338029f9849fa576e58a945828359754d4de957c0.exe
Resource
win7-20220901-en
Malware Config
Extracted
pony
http://pglipik.ru:2346/pony/mac.php
http://pfixsel.ru:2346/pony/mac.php
Targets
-
-
Target
fa5751c99e2ffee4d8ce6ec338029f9849fa576e58a945828359754d4de957c0
-
Size
80KB
-
MD5
b1e656e698ca0f1c94e2fbd4184a610f
-
SHA1
3bc346e24e2e8569bed03f09c787b46cfaeb348b
-
SHA256
fa5751c99e2ffee4d8ce6ec338029f9849fa576e58a945828359754d4de957c0
-
SHA512
a007dc241aeed20ee64934a740184345cdcf89601c2cd8b3cf9258c8c609a8b82bacde324897b98028343c55ff15116432881936fbd408263e5685a358603b4e
-
SSDEEP
1536:xrAJCsyJr5Do0P1W/v3HbCegeRLQI4DsWSQ607i:CEnJt9Q3bCERsEWLd
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-