General
-
Target
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6eaN.exe
-
Size
571KB
-
Sample
241226-c5aweavma1
-
MD5
77c247a34a0d0ec0648c4882d8dd5110
-
SHA1
70731974511cc49ba2ba85d56d570302c5eb03f4
-
SHA256
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6ea
-
SHA512
b1426504483437d56d40303fc5473e74b8d993e940ba3c64efcba657cce37b61c3ba58b58e949421e19ee63697f3bc55bad6144ef4ecaf39d034a2796298b59e
-
SSDEEP
12288:++ngP9XSjEEVA29cr605He6GurJRcnlaUG3Y:nOL605He6GurJRclNyY
Static task
static1
Behavioral task
behavioral1
Sample
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6eaN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6eaN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://kushilxiriuxm.net/11/gate.php
Targets
-
-
Target
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6eaN.exe
-
Size
571KB
-
MD5
77c247a34a0d0ec0648c4882d8dd5110
-
SHA1
70731974511cc49ba2ba85d56d570302c5eb03f4
-
SHA256
9f9c69fcb112a620df3e0520db004e633c42141e2d6e7029d23b9ce18a97e6ea
-
SHA512
b1426504483437d56d40303fc5473e74b8d993e940ba3c64efcba657cce37b61c3ba58b58e949421e19ee63697f3bc55bad6144ef4ecaf39d034a2796298b59e
-
SSDEEP
12288:++ngP9XSjEEVA29cr605He6GurJRcnlaUG3Y:nOL605He6GurJRclNyY
-
Pony family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-