Overview

overview

10

Static

static

10

2676-20-0x...ry.exe

windows7-x64

7

2676-20-0x...ry.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2676-20-0x0000000000400000-0x000000000041C000-memory.dmp

  • Size

    112KB

  • MD5

    5b10bb410b3d738d1905b6b94b3fa3a1

  • SHA1

    df84c2a68e5b8e96720f22683dd89b3116157d04

  • SHA256

    13c8f2de382a8288dc3a609b092c1abd4ebb3d8e2dc3d381078165d1953a6ffc

  • SHA512

    55eb7937c41a8a10674e688b056a8ec68df04d08ff1ec241a5c44590a102963a7abb6c2bd88e7e85b5ee70ae3d9d8f1910131ece4013db7e55363038fa74c2fe

  • SSDEEP

    1536:JTY6XSjuvoL+v3xsqTD/9Ur1eWwEc81Q1n577/jhCCtOoo/JTvMEIUkzmLJ87H:JTYYSjFi34rg81Q15bVO7qEI4LJ87

Score
10/10
upxpony

Malware Config

Extracted

Family

pony

C2

http://fishery.co.in/virgin/leo/gate.php

Attributes
  • payload_url

    http://fishery.co.in/virgin/leo/specification.exe

Signatures

  • Pony family
    pony
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2676-20-0x0000000000400000-0x000000000041C000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections