Overview

overview

10

Static

static

10

95d4eca450...26.exe

windows7-x64

10

95d4eca450...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d579a8bba252bf0a5bd698a7e0a95130.bin

  • Size

    40KB

  • MD5

    23da50c8fa00f77558d52fb22bebdf84

  • SHA1

    21060c0a40d344d7b634f3083d651eb9011d41d2

  • SHA256

    c65852e3a57bc91dfb7682518924fb7d9553905539fd40f834294d54e7737266

  • SHA512

    69b2670e44b22384a86739d33a2c0f56e5370e929263ec7ef3e68741c6b7a3e0c8885e130bcab3f2414af55de984c103917376b4b52832288fc9983c6c762953

  • SSDEEP

    768:NdRW6jAyCSnAr5wnLj8Pktjtk2nV/DYCZGIAAbGCcaLpDRlo7t:NtEybnA5oLIejF5Me7b0aLpll+t

Score
10/10
pony

Malware Config

Extracted

Family

pony

C2

http://www4.mafia2.co.nu/default.php?2frheGrNK89IUvOLmxrKavncv8rkxM6s3k

http://soarcard02.com/default.php?PO2SRhs6h5ya1FDDLvpYw4Ywpnx8StSKVjIpC

http://idca2011.com/default.php?BPAu5yL4mGGkdnvdfv8NVYKJBVG69PFrlwiwONm

http://tanincamera.com/default.php?qP5wxR89Y8jcsSCQBumO9GOIfn3UGKaVwxPx

http://at206.jlink.co.uk/default.php?Nn9QWfhPcrpvFU8jRN8UNXo1IaVlrzHQVN

Signatures

  • Pony family
    pony
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d579a8bba252bf0a5bd698a7e0a95130.bin
    .zip

    Password: infected

  • 95d4eca45056b0abfd6f8bb5cd05d5c30d25c1e7be9e2a3104b6a399939ef226.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    728afd0aeb7539a2a721ececf5f36865


    Headers

    Imports

    Sections