General
-
Target
bb1c072e80ceba6d373603f88b2988c801a3017c2a984050764de173006ebff9
-
Size
86KB
-
Sample
221205-jgt3pshd29
-
MD5
139042bf74816a883d6d5deaa215c1c8
-
SHA1
b83c90c9afbe0ae992232acab38b7599c4781f49
-
SHA256
bb1c072e80ceba6d373603f88b2988c801a3017c2a984050764de173006ebff9
-
SHA512
186b3311f5549030ab25052607386e0634a23a8f779263bf2c4315df9e3b253dbdc7a98498840529c5c4ad10e327cf0d2e87edd44d877ebdabbf9944c9a94fad
-
SSDEEP
1536:fk0YneYtHOLNXXKuUtajvsId//roSok/qe22wcQKlbduPg8MU:AneXUtodHroDk/tL9lR8M
Static task
static1
Behavioral task
behavioral1
Sample
bb1c072e80ceba6d373603f88b2988c801a3017c2a984050764de173006ebff9.exe
Resource
win7-20221111-en
Malware Config
Extracted
pony
http://salenj.info:9135/pic/fly.php
http://kehagy.info:9135/pic/fly.php
Targets
-
-
Target
bb1c072e80ceba6d373603f88b2988c801a3017c2a984050764de173006ebff9
-
Size
86KB
-
MD5
139042bf74816a883d6d5deaa215c1c8
-
SHA1
b83c90c9afbe0ae992232acab38b7599c4781f49
-
SHA256
bb1c072e80ceba6d373603f88b2988c801a3017c2a984050764de173006ebff9
-
SHA512
186b3311f5549030ab25052607386e0634a23a8f779263bf2c4315df9e3b253dbdc7a98498840529c5c4ad10e327cf0d2e87edd44d877ebdabbf9944c9a94fad
-
SSDEEP
1536:fk0YneYtHOLNXXKuUtajvsId//roSok/qe22wcQKlbduPg8MU:AneXUtodHroDk/tL9lR8M
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-