General
-
Target
b9962d0b637627b669554b6e496e63ada947774d8d30ac79d3c409f782c9b259
-
Size
102KB
-
Sample
221203-hatmxscc59
-
MD5
6ced0ba6fd057de94d044b5eec5ae04b
-
SHA1
7d05a0dd595149071fe82570c8b1e5caa70af3fe
-
SHA256
b9962d0b637627b669554b6e496e63ada947774d8d30ac79d3c409f782c9b259
-
SHA512
a36866f0f207a80e9290f677af04ffdb25c2cf275ebed1d379cbc5646aa614e5ef65e743caf80dc3dd2c9dc04c0f2d44a5c497ea61e9bfca86f43baa1c30a7aa
-
SSDEEP
3072:OQaoTOMPmEHftr/KlLzJMXYastx6VEiLTz+PfCE:RTRuEHJylL1QYuPLTz
Static task
static1
Behavioral task
behavioral1
Sample
b9962d0b637627b669554b6e496e63ada947774d8d30ac79d3c409f782c9b259.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://help2s.info:9135/pic/fly.php
http://hjw4is.info:9135/pic/fly.php
Targets
-
-
Target
b9962d0b637627b669554b6e496e63ada947774d8d30ac79d3c409f782c9b259
-
Size
102KB
-
MD5
6ced0ba6fd057de94d044b5eec5ae04b
-
SHA1
7d05a0dd595149071fe82570c8b1e5caa70af3fe
-
SHA256
b9962d0b637627b669554b6e496e63ada947774d8d30ac79d3c409f782c9b259
-
SHA512
a36866f0f207a80e9290f677af04ffdb25c2cf275ebed1d379cbc5646aa614e5ef65e743caf80dc3dd2c9dc04c0f2d44a5c497ea61e9bfca86f43baa1c30a7aa
-
SSDEEP
3072:OQaoTOMPmEHftr/KlLzJMXYastx6VEiLTz+PfCE:RTRuEHJylL1QYuPLTz
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-