Overview

overview

10

Static

static

10

59493695d8...18.exe

windows7-x64

10

59493695d8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59493695d80f5530ed1c197ea836d3dbJaffaCakes118

  • Size

    161KB

  • MD5

    59493695d80f5530ed1c197ea836d3db

  • SHA1

    60efde08501ff3cbeb8f3ac8914d7a1e9502a8bc

  • SHA256

    1d7bc20321433b66baaa9e8ad78ff3e11a9e8814775dbcaec89fcac1f253035a

  • SHA512

    5057645e78c70dfcbc6b8872a51f7e0323255bc6c000b56d9d51fded746387dd6dd134bd18f4d1c30d3595fa146d251b40185db76f4a1b16a3b65e300207c24f

  • SSDEEP

    3072:cTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKndI:cTLFuD6fOXlql/GLJrqqndtndhndKndI

Score
10/10
vmprotectpony

Malware Config

Extracted

Family

pony

C2

http://butterchoco.net/admin/bull/gate.php

Signatures

  • Pony family
    pony
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 59493695d80f5530ed1c197ea836d3dbJaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections