General
-
Target
c9a9fdd768de9f423e24dcf46d3ef838.exe
-
Size
702KB
-
Sample
230601-hqcpcada55
-
MD5
c9a9fdd768de9f423e24dcf46d3ef838
-
SHA1
5df4667ae097b4872e8cae8df0f003ac228650d1
-
SHA256
c82b062d79bbce1df07ed3dfe3d72faf33edd98a883f36344cc8cd4da9ffa36b
-
SHA512
dcaa04e202e71a238fce007a9c74db88a83b00f857d58483c638bec14fc524fb6231cb3e2758b42ba22f23f1a44f8871ea90c52e0b4ef7c56f7400c8ea0e4f02
-
SSDEEP
12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHn:Url6kD68JmloO5TYI1lOq6sb8hTHAn
Behavioral task
behavioral1
Sample
c9a9fdd768de9f423e24dcf46d3ef838.exe
Resource
win7-20230220-en
Malware Config
Extracted
pony
http://185.79.156.18/bit/03/gate.php
Targets
-
-
Target
c9a9fdd768de9f423e24dcf46d3ef838.exe
-
Size
702KB
-
MD5
c9a9fdd768de9f423e24dcf46d3ef838
-
SHA1
5df4667ae097b4872e8cae8df0f003ac228650d1
-
SHA256
c82b062d79bbce1df07ed3dfe3d72faf33edd98a883f36344cc8cd4da9ffa36b
-
SHA512
dcaa04e202e71a238fce007a9c74db88a83b00f857d58483c638bec14fc524fb6231cb3e2758b42ba22f23f1a44f8871ea90c52e0b4ef7c56f7400c8ea0e4f02
-
SSDEEP
12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHn:Url6kD68JmloO5TYI1lOq6sb8hTHAn
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-