General
-
Target
b13940cd910bc51f01d3f73df10d023e1fd653115e0e4955d13ba1f84bdaeb31
-
Size
160KB
-
Sample
221203-h3j9yshh9y
-
MD5
091330176781d71491194998a6df42f0
-
SHA1
9e11bf3fab559382f9b605719eae14bf55f18da2
-
SHA256
b13940cd910bc51f01d3f73df10d023e1fd653115e0e4955d13ba1f84bdaeb31
-
SHA512
b1b2dbece8ab20a708aa3575588608696f69cc8e6ece0957c25f0aba8d876794800a53fe733d7e3aac2722240d425c4b1ee3030e030ff69663049c6e5fe71775
-
SSDEEP
3072:FR4O2JYPWaBbHs2wlMyC2uDuDn7U0fQd22mfiELY8TOp5s:vH2+PWMlwlNCY3U0fQd9lLlbs
Static task
static1
Behavioral task
behavioral1
Sample
b13940cd910bc51f01d3f73df10d023e1fd653115e0e4955d13ba1f84bdaeb31.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://vkwoupi.info:719/way/open.php
http://sdidelo.info:719/way/open.php
Targets
-
-
Target
b13940cd910bc51f01d3f73df10d023e1fd653115e0e4955d13ba1f84bdaeb31
-
Size
160KB
-
MD5
091330176781d71491194998a6df42f0
-
SHA1
9e11bf3fab559382f9b605719eae14bf55f18da2
-
SHA256
b13940cd910bc51f01d3f73df10d023e1fd653115e0e4955d13ba1f84bdaeb31
-
SHA512
b1b2dbece8ab20a708aa3575588608696f69cc8e6ece0957c25f0aba8d876794800a53fe733d7e3aac2722240d425c4b1ee3030e030ff69663049c6e5fe71775
-
SSDEEP
3072:FR4O2JYPWaBbHs2wlMyC2uDuDn7U0fQd22mfiELY8TOp5s:vH2+PWMlwlNCY3U0fQd9lLlbs
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-