MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36ee7210598b9e9ceb184fc6bc29662a14f4e66e6f2f5139e677cf0147aed3de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36ee7210598b9e9ceb184fc6bc29662a14f4e66e6f2f5139e677cf0147aed3de
SHA3-384 hash: 541d865f66d77b34af2f8dc739ae5019d7805962d27fb8cb47f738dfaec7608643b20eb107cd641a6aef8efebe5fdbc1
SHA1 hash: aa5ee10c7b34ff015d6e598e247eb1232cd16409
MD5 hash: 97cd34562c25017ac5170de660ecbfe0
humanhash: jig-oklahoma-equal-robin
File name:IECO Qatar PO A129670 _pdf.zip
Download: download sample
Signature Pony
Create hunting rule
File size:487'434 bytes
First seen:2020-06-12 06:34:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KaM+GGAt1u/WLGgMFB63yloOfUg5YOog3aEHLSSn3J+On:C+BAXueLrVqUgH37rr5+On
TLSH 28A42346BE022079F199C10F4E76858203286F71247DD6AEEF631DF91A95AC5C70F8B9
Reporter abuse_ch
Tags:Pony zip


Avatar
abuse_ch
Malspam distributing Pony:

HELO: hu.hubtimeap.live
Sending IP: 45.95.171.242
From: IECO Qatar <biggawayne@hotmail.com>
Subject: Re: Urgent PO for June A129670 / IECO Qatar
Attachment: IECO Qatar PO A129670 _pdf.zip (contains "LOKI.exe")

Pony C2:
http://shinhan-vina.com.vn/hd/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
452
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.245818.10883.3329.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:36:08 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g3xheeczropjz2yyj7dlyklgfikpjzton4xvcopgo7hqcr5o2ppa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

zip 36ee7210598b9e9ceb184fc6bc29662a14f4e66e6f2f5139e677cf0147aed3de

(this sample)

Pony

Executable exe 80b9257f924aef8ac5a1a724234ddcd6b67bee79819202bb7b5d4586b35164c7

  
Dropping
MD5 030cb125ba97deb600d8a1137087754b
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80b9257f924aef8ac5a1a724234ddcd6b67bee79819202bb7b5d4586b35164c7

Comments