MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83
SHA3-384 hash: c626959f4ecc76bebf480c4e79513e277d605623b063590ed28965e9cdcb2a12d767415b7d135adf9594134f765c00ff
SHA1 hash: 590a99816718d0861948da9c90d6fe9c89fa147c
MD5 hash: b536911c6b43c4f64dade335c5c3a399
humanhash: rugby-apart-magnesium-harry
File name:93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83
Download: download sample
Signature Pony
Create hunting rule
File size:139'776 bytes
First seen:2020-11-14 18:19:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be19e18d6a8b41631d40059031a928bb (28 x Pony, 3 x Loki, 3 x NetWire)
ssdeep 3072:4oTv/p/6pTho4yEPhXzpqq/c+tPtdHVWcg:lTn4o4yKzb/ztV
Threatray 146 similar samples on MalwareBazaar
TLSH 4FD3226920CC046CD54ED83158E69EE2F36FADC0882D197B1FE2FF277A75A0A1471934
Reporter seifreed
Tags:Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
442
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Fareit-9790210-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Reading critical registry keys
DNS request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/535476
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Lokibot Info Stealer
Detected unpacking (changes PE section rights)
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Generic Dropper
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 316837 Sample: gyESh7Mzcf Startdate: 15/11/2020 Architecture: WINDOWS Score: 100 29 myp0nysite.ru 2->29 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Multi AV Scanner detection for domain / URL 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 6 other signatures 2->53 9 gyESh7Mzcf.exe 3 2->9         started        13 wscript.exe 1 2->13         started        signatures3 process4 file5 27 C:\Users\user\AppData\...\filename.bat, PE32 9->27 dropped 55 Detected unpacking (changes PE section rights) 9->55 57 Detected Lokibot Info Stealer 9->57 59 Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code 9->59 61 Tries to steal Mail credentials (via file registry) 9->61 15 gyESh7Mzcf.exe 1 14 9->15         started        19 filename.bat 13->19         started        signatures6 process7 dnsIp8 31 myp0nysite.ru 194.67.71.186, 49733, 49747, 80 AS-REGRU Russian Federation 15->31 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->33 35 Tries to harvest and steal ftp login credentials 15->35 37 Tries to harvest and steal browser information (history, passwords, etc) 15->37 21 cmd.exe 1 15->21         started        39 Antivirus detection for dropped file 19->39 41 Detected unpacking (changes PE section rights) 19->41 43 Detected Lokibot Info Stealer 19->43 45 2 other signatures 19->45 23 filename.bat 19->23         started        signatures9 process10 process11 25 conhost.exe 21->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:21:28 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sprrte66ee4ibfecq2ylrvzenvmhbirugb6zjz4zc4bvob2kj2bq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
59c17773776261d45122a0d067088654268ca71b329a6e9495105c500c12c8c1
Pony
5a8239ffd5e37023816296c83bf64261d7461cc373669a881a1b2284d767d1ed
Pony
5dbfd22543849bd392e080c351227f31137993f23ee7ac5a3184322e43d73745
Pony
68629701b12d1300254ce04807b894fd8195bd36ce6b6ceebe5beba5d60cf5d3
Pony
757031344cc71050e625abd7d6e413e07c506d539f834835413ca1b656898b34
Pony
948b5d4daa9864aae1297b9481a1bcee316f723af481e983dbff09fcd8a24563
Pony
9e7bc04d9b7a15b73175902e3c8cd0f245353bb88dfe0a68d122616255aed42f
Pony
b3aac3c1fed205d6c1e36f80475cdb4b243f6fb7b2d275f360867aa6dcec5fe8
Pony
c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed
Pony
e06424448f76d743640e518b0fec78a025fee0856f6afa507e077e5dcc118e3c
Pony
+ 136 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201114-hxlz26lv4e/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83
MD5 hash:
b536911c6b43c4f64dade335c5c3a399
SHA1 hash:
590a99816718d0861948da9c90d6fe9c89fa147c
Link:
https://www.unpac.me/results/74b66730-1eba-401f-869c-d3b419c14cfc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tofsee
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments