MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88c63762f85d92709ec567c3a3de9363589c4dd8777e469e5722851c5d3ed5a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88c63762f85d92709ec567c3a3de9363589c4dd8777e469e5722851c5d3ed5a3
SHA3-384 hash: 12f0c783bf57e2b25d68bd86a104abf3df0c563abd4707b661bfe8c31d4cf4f5da554f1f59060143b9730c5e90301ef5
SHA1 hash: c73d214842f6a616c08d98c57529497e4136d35d
MD5 hash: 4d06eb7d0e4f07aaa46a5ba0f17f7b75
humanhash: helium-king-magnesium-wolfram
File name:88C63762F85D92709EC567C3A3DE9363589C4DD8777E4.exe
Download: download sample
Signature Pony
Create hunting rule
File size:580'632 bytes
First seen:2021-04-09 08:15:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4a6a99807fc6ac1782a7c36920c55c1c (1 x Pony)
ssdeep 3072:g+S8ZroSR4EaGxbSkeyV1NFG0ZRE+SFYlAMFjr/8WTDAYbkgFEvgfvrdaObCoSTS:gJSYGbSS5Un+kWASjr/gYdm7TU0Jk
Threatray 1'393 similar samples on MalwareBazaar
TLSH 70C4C8BBFA5A81FBE0ED08F57B48885632B9F9F1D04D344B13C46195E0EE4E0592E91E
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Pony C2:
http://185.62.189.113/ohwen1/02/gate.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.62.189.113/ohwen1/02/gate.php https://threatfox.abuse.ch/ioc/7497/

Intelligence

File Origin
# of uploads :
1
# of downloads :
567
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
88C63762F85D92709EC567C3A3DE9363589C4DD8777E4.exe
Verdict:
No threats detected
Analysis date:
2021-04-09 08:17:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11a72f52-3473-43de-b390-7eed846b736d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Fareit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133327/
Detection(s):
Win.Trojan.Fareit-6872395-0
Create hunting rule

Win.Trojan.Fareit-6882897-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Reading critical registry keys
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Enabling autorun by creating a file
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/671091
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Generic Dropper
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384489 Sample: 88C63762F85D92709EC567C3A3D... Startdate: 09/04/2021 Architecture: WINDOWS Score: 100 27 Malicious sample detected (through community Yara rule) 2->27 29 Antivirus / Scanner detection for submitted sample 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 4 other signatures 2->33 8 88C63762F85D92709EC567C3A3DE9363589C4DD8777E4.exe 4 2->8         started        12 wscript.exe 1 2->12         started        process3 file4 25 C:\Users\user\AppData\Roaming\...\vscdme.exe, PE32 8->25 dropped 35 Detected unpacking (changes PE section rights) 8->35 37 Detected unpacking (overwrites its own PE header) 8->37 39 Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code 8->39 41 2 other signatures 8->41 14 88C63762F85D92709EC567C3A3DE9363589C4DD8777E4.exe 1 14 8->14         started        17 vscdme.exe 1 12->17         started        signatures5 process6 signatures7 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->43 45 Tries to harvest and steal ftp login credentials 14->45 47 Tries to harvest and steal browser information (history, passwords, etc) 14->47 19 cmd.exe 1 14->19         started        49 Antivirus detection for dropped file 17->49 51 Multi AV Scanner detection for dropped file 17->51 53 Detected unpacking (changes PE section rights) 17->53 55 4 other signatures 17->55 21 vscdme.exe 17->21         started        process8 process9 23 conhost.exe 19->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88c63762f85d92709ec567c3a3de9363589c4dd8777e469e5722851c5d3ed5a3/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2018-05-14 20:03:44 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdddoyxylwjhbhwfm7b2hxutmnmjytoyo57enhsxekcryxj62wrq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
0999db34e8587ca82c53264b3a8ba8bb45e456705d32f514f2eb414b4e0a2a4b
Pony
59c17773776261d45122a0d067088654268ca71b329a6e9495105c500c12c8c1
Pony
5a8239ffd5e37023816296c83bf64261d7461cc373669a881a1b2284d767d1ed
Pony
5dbfd22543849bd392e080c351227f31137993f23ee7ac5a3184322e43d73745
Pony
68629701b12d1300254ce04807b894fd8195bd36ce6b6ceebe5beba5d60cf5d3
Pony
93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83
Pony
948b5d4daa9864aae1297b9481a1bcee316f723af481e983dbff09fcd8a24563
Pony
9e7bc04d9b7a15b73175902e3c8cd0f245353bb88dfe0a68d122616255aed42f
Pony
b3aac3c1fed205d6c1e36f80475cdb4b243f6fb7b2d275f360867aa6dcec5fe8
Pony
c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed
Pony
+ 1'383 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer
Link:
https://tria.ge/reports/210409-3kpg9wtlze/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks installed software on the system
Deletes itself
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Unpacked files
SH256 hash:
88c63762f85d92709ec567c3a3de9363589c4dd8777e469e5722851c5d3ed5a3
MD5 hash:
4d06eb7d0e4f07aaa46a5ba0f17f7b75
SHA1 hash:
c73d214842f6a616c08d98c57529497e4136d35d
Link:
https://www.unpac.me/results/cdac2597-4020-4182-9c4d-83b350681b98/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88c63762f85d92709ec567c3a3de9363589c4dd8777e469e5722851c5d3ed5a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/133327/

Comments