MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0999db34e8587ca82c53264b3a8ba8bb45e456705d32f514f2eb414b4e0a2a4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0999db34e8587ca82c53264b3a8ba8bb45e456705d32f514f2eb414b4e0a2a4b
SHA3-384 hash: a16e13d599897ea2b5bea6cbd71fa5892e22c56a9e415a4a13588aa472a01166395e4623f39327fb3cd1da2137742b33
SHA1 hash: 6860c2d8ca88fbd33ac26df389305bb390b2a24d
MD5 hash: 6360c0ce7075745365dd51ba6dddb962
humanhash: bulldog-pizza-arkansas-early
File name:78.142.19.172__winvps_1_com__gerd__scvhost.exe.malw
Download: download sample
Signature Pony
Create hunting rule
File size:450'560 bytes
First seen:2020-03-18 19:13:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91e4da2010d2a7722273bf07b37aba87 (1 x Pony)
ssdeep 6144:HPqwibQwkFRlVTLPXxygMVko39Da/le0:HPqw3NRlVhygMa
TLSH 2BA42B4656E69FD0F0AE9CF39F3272E1397935393F4571835EA05EA98E3B088ADD1081
Reporter ov3rflow1
Tags:malw Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Jaik-6652012-0
Create hunting rule

Win.Dropper.Jaik-6652013-0
Create hunting rule

Win.Malware.Noon-6915599-0
Create hunting rule

Win.Malware.Vbkryjetor-6915904-0
Create hunting rule

Win.Packed.Vbkryjetor-7191357-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2018-08-13 10:24:54 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
pony
Create hunting rule
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0999db34e8587ca82c53264b3a8ba8bb45e456705d32f514f2eb414b4e0a2a4b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/41499/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef

Comments