MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd
SHA3-384 hash: 2ad95b6bfb07b4b90f1ea0c68be492988cda65c41aea24be54168863fe048e938412b66798e99ca6a306e8b79fa1476b
SHA1 hash: 2352650c80539d749d30d69057b2be57712ea948
MD5 hash: d82c43e67b4297d2c23244b44a8caac4
humanhash: pluto-johnny-india-montana
File name:a4588f57322665c795bdf720abc23ffc
Download: download sample
Signature Pony
Create hunting rule
File size:189'771 bytes
First seen:2020-11-17 14:01:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2727f1bbd099fb2b359b7df625ad4dd0 (8 x Pony)
ssdeep 3072:p7C65VEFom+csyR8Yji3LzPYlvmmMzEo5eU5QQlVrI9l4DbHSrwHlm/2z4:rcoRVyR8AXlvmmvowPo2aDbHqoFz4
TLSH 94044A3AF1529037DB0894F414C91ACA0E44CF786A528797BE5EBA7D6CE101DAC47EF2
Reporter seifreed
Tags:Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
481
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Zbot-9791148-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Reading critical registry keys
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Brute forcing passwords of local accounts
Result
Threat name:
Fareit
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/539468
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Found C&C like URL pattern
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Fareit stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 14:02:16 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u6bujmkyugpaodbg4zwekhl65uuen43ajden3q3ftfgajcrilhoq._file
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer
Link:
https://tria.ge/reports/201117-mq69we6hj2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Unpacked files
SH256 hash:
a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd
MD5 hash:
d82c43e67b4297d2c23244b44a8caac4
SHA1 hash:
2352650c80539d749d30d69057b2be57712ea948
Link:
https://www.unpac.me/results/11160244-0777-4bef-974e-c28d2535aa5a/
SH256 hash:
39bac135488ef75238eddfa68dc083df5d6ac3ad575795a3121f00337b164798
MD5 hash:
5ebf8ae5098e73935fe6796e82c9118e
SHA1 hash:
9f95257d8176dfb46797ae7b0ab1a264b3c7a9a4
Detections:
win_pony_auto
Create hunting rule
Link:
https://www.unpac.me/results/11160244-0777-4bef-974e-c28d2535aa5a/
Parent samples :
66b46a26acf7e77daa218e4dd587f11ae0f1bdfc699c9fe543fb3224568fbeec
7cb751b77521c3ed5b38e59cc9e9444cb7eff428e1d94c10b800a6982ac1abda
92c2328cddcc51230e0dfcfd2b819b6778d73328770a941aed80aab9542a465d
fd99712113fbc6ed5c88886da730806a765d96231fe27f5697b0bf5a75124b36
200ea893543df1ab909c78ed95c3f56b1693b283a6b210bc9d8f0694faab1168
074be99cbe3fff4403a53f8ed02772349f764146134c4ab349e1f982e6134cf2
1ea49ae9451ec1ad1e3411b2ad1fc525764d2ca956709239ff6784eae28b71dd
a78344b158a19e070c26e66c451d7eed2846f36048c8ddc365994c048a2859dd
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments