General
-
Target
c1090629855ae54545498aaa7738e352.exe
-
Size
702KB
-
Sample
230531-284qbsbh8w
-
MD5
c1090629855ae54545498aaa7738e352
-
SHA1
b768286921741aa0ce47c6485a922dc76f4d732f
-
SHA256
71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33
-
SHA512
39817b1283b86f8435da7c2f633d130ae2046a45c21360bff803f4130a1f035a601f25bd65acedc84aa6b46adf4b0a09713195de648cbcfe79047dd2a86c7f59
-
SSDEEP
12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHl:Url6kD68JmloO5TYI1lOq6sb8hTHAl
Behavioral task
behavioral1
Sample
c1090629855ae54545498aaa7738e352.exe
Resource
win7-20230220-en
Malware Config
Extracted
pony
http://185.79.156.18/bit/03/gate.php
Targets
-
-
Target
c1090629855ae54545498aaa7738e352.exe
-
Size
702KB
-
MD5
c1090629855ae54545498aaa7738e352
-
SHA1
b768286921741aa0ce47c6485a922dc76f4d732f
-
SHA256
71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33
-
SHA512
39817b1283b86f8435da7c2f633d130ae2046a45c21360bff803f4130a1f035a601f25bd65acedc84aa6b46adf4b0a09713195de648cbcfe79047dd2a86c7f59
-
SSDEEP
12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHl:Url6kD68JmloO5TYI1lOq6sb8hTHAl
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-