Behavioral task
behavioral1
Sample
b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67N.exe
Resource
win10v2004-20241007-en
General
-
Target
b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67N.exe
-
Size
120KB
-
MD5
a189c36fc643d52fe54f6d70d31539e0
-
SHA1
3bb5be0b3beeac77d6f96402e44b0464b029eae2
-
SHA256
b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67
-
SHA512
b359ef7565c21becf3644f3707894b90a6b19b859ce5c4756c3d83ffc9564e84d4e866f2b838519bdc3dd4cb281a4f8970622a6feca7023001ddbeecaa18196b
-
SSDEEP
1536:tGvi5NE3qTIS18lNaHaPzeHNWg/tdFTBxeOkVy3pCtkzbknt/NDI+9yvnrVv:8KnEkaPzKyO0SpCeOt/NDtsrV
Malware Config
Extracted
pony
http://ct70895.tmweb.ru/panel/gate.php
Signatures
-
Pony family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67N.exe
Files
-
b52b6fc6f64de3c618b9429571338a45e27fc7e3df20b45806718e41b85b9e67N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ