General
-
Target
8A279783229E688A2324C224904473431CC5CAB7E6B85.exe.bin
-
Size
466KB
-
Sample
230501-vw7swsgf55
-
MD5
2d8f60c9459f321d765ce1e50e49f41a
-
SHA1
15797084c07f8ce0ef427fd868a81ab95b10f549
-
SHA256
8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384
-
SHA512
c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70
-
SSDEEP
12288:jHZKdRVIZcXwxHr7ypW4eSs1k2s5YqK7:FumcXg7aeSsQY9
Static task
static1
Behavioral task
behavioral1
Sample
8A279783229E688A2324C224904473431CC5CAB7E6B85.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8A279783229E688A2324C224904473431CC5CAB7E6B85.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
pony
http://roadstar.comeze.com/chinedu/gate.php
Targets
-
-
Target
8A279783229E688A2324C224904473431CC5CAB7E6B85.exe.bin
-
Size
466KB
-
MD5
2d8f60c9459f321d765ce1e50e49f41a
-
SHA1
15797084c07f8ce0ef427fd868a81ab95b10f549
-
SHA256
8a279783229e688a2324c224904473431cc5cab7e6b8538ac8256877cfd58384
-
SHA512
c076c9588d48ded127c753d8d5e9d321535111042f97c286dc41711af86d02beeeec28b6a08de1d413462d9a5c7b4d20981d1327a5ecc4a5e04dba7edbb72b70
-
SSDEEP
12288:jHZKdRVIZcXwxHr7ypW4eSs1k2s5YqK7:FumcXg7aeSsQY9
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-