General
-
Target
b6b1b4d857b9c6e39c0b958e4c848525
-
Size
137KB
-
Sample
240306-gtd6xacf3t
-
MD5
b6b1b4d857b9c6e39c0b958e4c848525
-
SHA1
204195d5f949200fd5282117325cc1ce67ee828e
-
SHA256
b45d48a9962db4aa1897de82b8534e0552970df119ab710d2180ce2a417b65e2
-
SHA512
3c4ab6e2b9da5f769891632c574275c4f27bca20dcfc428d7dc2c66e3b808ea9c1f81c8f3e89ed2c897029ed9cc2b897b691fa3735aed5781b9553108c37f6b9
-
SSDEEP
1536:/qaBDw6fxE4a6foBJ/fYXSCsF02GXu+rdnV3BjU/hIzcCIqA6cwgvIq/j0X5iQD:/qaWcE1EOB9otHeyzzA6c5/Ut
Static task
static1
Behavioral task
behavioral1
Sample
b6b1b4d857b9c6e39c0b958e4c848525.exe
Resource
win7-20240221-en
Malware Config
Extracted
pony
http://buyandsmile.atomclick.co:8080/pony/gate.php
http://dare2dreamz.com:8080/pony/gate.php
-
payload_url
http://desprecs.ro/50dw.exe
http://thehorsetailor.com/7QtL.exe
http://h--o.com/KdWNRWVz.exe
Targets
-
-
Target
b6b1b4d857b9c6e39c0b958e4c848525
-
Size
137KB
-
MD5
b6b1b4d857b9c6e39c0b958e4c848525
-
SHA1
204195d5f949200fd5282117325cc1ce67ee828e
-
SHA256
b45d48a9962db4aa1897de82b8534e0552970df119ab710d2180ce2a417b65e2
-
SHA512
3c4ab6e2b9da5f769891632c574275c4f27bca20dcfc428d7dc2c66e3b808ea9c1f81c8f3e89ed2c897029ed9cc2b897b691fa3735aed5781b9553108c37f6b9
-
SSDEEP
1536:/qaBDw6fxE4a6foBJ/fYXSCsF02GXu+rdnV3BjU/hIzcCIqA6cwgvIq/j0X5iQD:/qaWcE1EOB9otHeyzzA6c5/Ut
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-