Overview

overview

10

Static

static

10

2292-13-0x...ry.exe

windows7-x64

7

2292-13-0x...ry.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2292-13-0x0000000000400000-0x000000000041C000-memory.dmp

  • Size

    112KB

  • MD5

    2607fb5beda0716eaaa0b9daebe8e19e

  • SHA1

    92dfc4dbb76072e01a5bde0b86d2845a3f97c920

  • SHA256

    4f108b6f7b28fd324a23b34dbc126c7d07c62ff49e82933257a643455a0de6cd

  • SHA512

    e78ad80004b58eb8e5ad2cf5aeeb301681c5a227ca1c9ce718b55e7c30bea64058c26859c463237a0d36125e2ac75517103b1f14dab8373497effcee3c326b51

  • SSDEEP

    1536:Ydng3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEI8LkzZGkvXG:HdOy+ubiDBzv+1H4OgYEIzGkv2

Score
10/10
upxpony

Malware Config

Extracted

Family

pony

C2

http://criminallawdc.com/default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh

http://1callalert.com/default.php?qA6UBcu6AjB8x9JqvOtC3aBFoTU5C21aEDB34

http://semtly.com/default.php?8xRRepn5vWSVMvIgKDkgQwCMvQZR6bUhD9vdP1U9P

http://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6

http://e3pos.com/default.php?SltKWD44EdkECNMISztnGyO3arr5mRG6rjiVzFkw1V

Signatures

  • Pony family
    pony
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2292-13-0x0000000000400000-0x000000000041C000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections