pony | 1a2211aec6c3e5e27a67f6907a7611f5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1a2211aec6c3e5e27a67f6907a7611f5.exe
Size 92KB
Sample240102-e7p48adehp
SHA256 c1be3c17f856344daf7ab2ad08074e94145f371698f52bc93b5dde4030c53f62
MD5 1a2211aec6c3e5e27a67f6907a7611f5
SHA1 169f9ea72a8cc089614e74353240dc57898732ad
SHA512 50d831fe66728162ea95703ccb5c3a7a1a3e286301eaac7a0f55f903b232e357231daaa38bd93c59b82f2e46e69d4eb5d001b44b84868b9e89885c8e9db90a81
SSDEEP 1536:n/nzp0YL6qTSC9UGBzmJr4A4ZrqYBmAE4KA9JOnJOBfTvSkzbk1S8/b:/z6aIImJRbOBzkt/b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony

Malware Config

Extracted

Family

pony

http://mnpupdate.sytes.net/icrm/gate.php

Signatures

Pony family
pony

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a2211aec6c3e5e27a67f6907a7611f5.exe

File Explorer

1a2211aec6c3e5e27a67f6907a7611f5.exe

.exe 92KB

1a2211aec6c3e5e27a67f6907a7611f5.exe

IMPHASH 085f942c74d09a78dcd2b95a4c1c7441
SHA256 c1be3c17f856344daf7ab2ad08074e94145f371698f52bc93b5dde4030c53f62
MD5 1a2211aec6c3e5e27a67f6907a7611f5
SHA1 169f9ea72a8cc089614e74353240dc57898732ad
SHA512 50d831fe66728162ea95703ccb5c3a7a1a3e286301eaac7a0f55f903b232e357231daaa38bd93c59b82f2e46e69d4eb5d001b44b84868b9e89885c8e9db90a81
SSDEEP 1536:n/nzp0YL6qTSC9UGBzmJr4A4ZrqYBmAE4KA9JOnJOBfTvSkzbk1S8/b:/z6aIImJRbOBzkt/b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA ReadFile CloseHandle WriteFile lstrlenA GlobalLock GlobalUnlock LocalFree LocalAlloc GetTickCount lstrcpyA lstrcatA GetFileAttributesA ExpandEnvironmentStringsA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile LoadLibraryA GetProcAddress GetTempPathA CreateDirectoryA DeleteFileA GetCurrentProcess WideCharToMultiByte GetLastError lstrcmpA CreateToolhelp32Snapshot Process32First OpenProcess Process32Next FindFirstFileA lstrcmpiA FindNextFileA FindClose GetModuleHandleA GetVersionExA GetLocaleInfoA GetSystemInfo GetWindowsDirectoryA GetPrivateProfileStringA SetCurrentDirectoryA GetPrivateProfileSectionNamesA GetPrivateProfileIntA GetCurrentDirectoryA lstrlenW MultiByteToWideChar Sleep GetModuleFileNameA LCMapStringA ExitProcess SetUnhandledExceptionFilter

ole32

CreateStreamOnHGlobal GetHGlobalFromStream CoCreateGuid CoTaskMemFree CoCreateInstance OleInitialize

user32

wsprintfA

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA RegEnumKeyExA RegCreateKeyA RegSetValueExA IsTextUnicode RegOpenCurrentUser RegEnumValueA GetUserNameA

wininet

InternetCrackUrlA InternetCreateUrlA

shlwapi

StrStrIA StrRChrIA StrToIntA StrStrA StrCmpNIA StrStrIW

urlmon

ObtainUserAgentString

wsock32

inet_addr gethostbyname socket connect closesocket send select recv setsockopt WSAStartup

userenv

LoadUserProfileA UnloadUserProfile