Behavioral task
behavioral1
Sample
308-55-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
308-55-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
308-55-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
cf5711e6257ebab5ca62a496ac0f7d2b
-
SHA1
02f0140318fd6c8c0e4b44ad814e7b1cd7d45ce2
-
SHA256
733f274e95fdef1635c8df867d8818bb1f79c9470dbd0634bd70e272636a28e8
-
SHA512
5666cd60022b4c3b4925ad4a448d435bc4ce49a95b742238aa0867d209166ff6272e97633a35dcc4d08ca298f69e3606cb22c913690bab96ee02d81668bd6f99
-
SSDEEP
1536:fPjmLSJrpi4qTnl6AVY78UVErZ+RZ27lRUOOPc2Tv8kzbd/j1A2xwSLlLkT2:36mrcpY7Tw+RZpOOPJd/ju2xXq2
Malware Config
Extracted
pony
http://abemuggs.com/forum/viewtopic.php
http://abes.co/forum/viewtopic.php
http://abes.net/forum/viewtopic.php
http://abesburger.com/forum/viewtopic.php
-
payload_url
http://www.edgwaretown.co.uk/fR6CTg.exe
http://68.228.8.88/GG0sqZw9.exe
http://mobilidea.com.mx/1wkYeV.exe
http://academicjourneyonline.com/ExA.exe
Signatures
-
Pony family
Files
-
308-55-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE