MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f51a40069dd869e63c363159cbf84395264e9c620f0049a7b18fd45dfaba60a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f51a40069dd869e63c363159cbf84395264e9c620f0049a7b18fd45dfaba60a
SHA3-384 hash: 820991aabea2f0b76aad4fd6668d9b2946285f90ec98c63b6ebab7e322ae971e21ea913c64b4cb509a853fe197d081c7
SHA1 hash: 0f97ce66a84e34c728f6f862a9851fc0559ad081
MD5 hash: ca69a907053b5d2207bfcc224d50c949
humanhash: green-fix-grey-alaska
File name:Invoice AWB00015564.gz
Download: download sample
Signature Pony
Create hunting rule
File size:385'028 bytes
First seen:2020-10-27 14:33:51 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:zGNlHdMgH93KHCHN7W/6qTyXGgi2AC4PJGBbAG7CqgKBtYwm0K1ejnckQ2Ir63hC:zyJdMgwiHN7W/6qTyXGkQJEymYwm0K8Q
TLSH 668423D9789F71B4A07ED2AF9F20BB3804BF784DAC66257CDD410236B2815D7C24A45B
Reporter abuse_ch
Tags:DHL gz Pony


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.tuguhotels.com
Sending IP: 103.219.251.235
From: DHL EXPRESS <saigonsan@tuguhotels.com>
Reply-To: DHL EXPRESS <customerservices@dhl.com>
Subject: RE: Outstanding Invoice AWB00015564 with the Requested Paperwork
Attachment: Invoice AWB00015564.gz (contains "Invoice AWB00015564.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
710
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f51a40069dd869e63c363159cbf84395264e9c620f0049a7b18fd45dfaba60a/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 13:07:47 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5i2iadj3wdj4y6dmmkzzp4ehfjgj2ogedyajgt3dd6ulx5luyfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f51a40069dd869e63c363159cbf84395264e9c620f0049a7b18fd45dfaba60a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

gz 0f51a40069dd869e63c363159cbf84395264e9c620f0049a7b18fd45dfaba60a

(this sample)

Pony

Executable exe 9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377

  
Dropping
MD5 9ab53021910d341db01247be219738dd
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377

Comments