MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd
SHA3-384 hash: c709c002fef1d141340ea95eacdbdf6ec494b72da4c0746f177ba0071f5088ca93450c9d9451ac82af2735c25216d190
SHA1 hash: 0abfa77823d3db459adca3fc6022f01b7f0f65ee
MD5 hash: b15e0c0180a740db7bac2b8452661a34
humanhash: zebra-tennessee-diet-diet
File name:5cbfb6832f883b824260de1e4bc4d3d1
Download: download sample
Signature Pony
Create hunting rule
File size:189'771 bytes
First seen:2020-11-17 11:38:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2727f1bbd099fb2b359b7df625ad4dd0 (8 x Pony)
ssdeep 3072:BzOK5VEFom+co/5YrifxVf5oHAvdd805eU5QQlVrI9l4DbHSrwHlm/2z2:HcoR5/5YraoHAvU0wPo2aDbHqoFz2
Threatray 151 similar samples on MalwareBazaar
TLSH 97044A2AF1529037DB0494F414C91ACA0E44CF786A528B97BE5EBA7D6CE101DAC47EF2
Reporter seifreed
Tags:Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
473
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Zbot-9791148-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Reading critical registry keys
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Brute forcing passwords of local accounts
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:39:49 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2sjv2kfd3a22hrucgzk2h6fev3e2lfjkzyjeop7m6covyulohoq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
25fe3949ffb0fb49cc27992f89558c45abdda778e775a58fde4647fb36dcafff
Pony
4188d06ab94a8883fd4864b3690168649de6f1ae86d8b2c6a2778f7f46a60e02
Pony
489f3a394942157dbc0ed01c09989288c1a87a2d7b80a6382a4338094b35d710
Pony
4bb2312117a9cca54bbb57f052f7a012d1971b1895fee03e35f6b657ac506bd1
Pony
7cb751b77521c3ed5b38e59cc9e9444cb7eff428e1d94c10b800a6982ac1abda
Pony
81e4e55c3b927e248c48e3c5414509e7808755d74b3504b709fbdfecba19f613
Pony
9da2fc8e17dff51ad3de4ef9ff78d4196bd530a4aaa8e3c07e81e56df7a5c241
Pony
d67bc999b9c89a4c2ccd9832b42accf936e6b4403d27226c8de973ec0987d945
Pony
d768486542d55538cb90b21c8563f395ed3d5148733e23a67bc5dba74b811233
Pony
e3d26ec0477d9578aaa7762c27514f91c1c9503935c9d1f48cf34698de2ac9cf
Pony
+ 141 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer
Link:
https://tria.ge/reports/201117-thw3cgfghj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Unpacked files
SH256 hash:
1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd
MD5 hash:
b15e0c0180a740db7bac2b8452661a34
SHA1 hash:
0abfa77823d3db459adca3fc6022f01b7f0f65ee
Link:
https://www.unpac.me/results/a372f907-1af8-468e-9151-44e86c3e8f61/
SH256 hash:
39bac135488ef75238eddfa68dc083df5d6ac3ad575795a3121f00337b164798
MD5 hash:
5ebf8ae5098e73935fe6796e82c9118e
SHA1 hash:
9f95257d8176dfb46797ae7b0ab1a264b3c7a9a4
Detections:
win_pony_auto
Create hunting rule
Link:
https://www.unpac.me/results/a372f907-1af8-468e-9151-44e86c3e8f61/
Parent samples :
66b46a26acf7e77daa218e4dd587f11ae0f1bdfc699c9fe543fb3224568fbeec
7cb751b77521c3ed5b38e59cc9e9444cb7eff428e1d94c10b800a6982ac1abda
92c2328cddcc51230e0dfcfd2b819b6778d73328770a941aed80aab9542a465d
fd99712113fbc6ed5c88886da730806a765d96231fe27f5697b0bf5a75124b36
200ea893543df1ab909c78ed95c3f56b1693b283a6b210bc9d8f0694faab1168
074be99cbe3fff4403a53f8ed02772349f764146134c4ab349e1f982e6134cf2
1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd
a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments