Overview

overview

10

Static

static

10

2915da696f...8c.exe

windows7-x64

3

2915da696f...8c.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2915da696f022a2a780607a664e16ee6283d1deaedc5a0b739e9c194ba6cd58c

  • Size

    80KB

  • MD5

    5477f4865f37cdbdce2897353d4a3a81

  • SHA1

    d0628fa9fe6940b7fb45db9ae31cf7b95cb3d8e1

  • SHA256

    2915da696f022a2a780607a664e16ee6283d1deaedc5a0b739e9c194ba6cd58c

  • SHA512

    bcc499352361944164166d879db8a8f641067353b40aac1e5a160bd2b9dde0530bebbf0bc447d4ef6378c24580c58a2a61039dcdc2ec84f98bb962d0f9db7788

  • SSDEEP

    1536:xSwNE6vqTg1pvNeFrCiPZuDVKR/70933o1TvxEo3kZcH:xNJrlsPZSVScoEogcH

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://62.112.130.165:8080/pony/gate.php

http://83.174.131.142:8080/pony/gate.php
Attributes
  • payload_url

    http://gnarlybuys.info/LMbir.exe

    http://mancomunidadcentro.org.bo/wN7iM.exe

    http://100s.pl/jQnoeUC.exe

    http://medyapark.com.tr/w9CTkwA.exe

Signatures

  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2915da696f022a2a780607a664e16ee6283d1deaedc5a0b739e9c194ba6cd58c
    .exe windows:4 windows x86 arch:x86

    24372f561e1e1d10d855a874a39472c3


    Headers

    Imports

    Sections