MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b55bc5be4e26953b510e035aaa1f821babf4f641e830a80e37fe8d6ba34fab29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b55bc5be4e26953b510e035aaa1f821babf4f641e830a80e37fe8d6ba34fab29
SHA3-384 hash: 9d8d8bc73d6d27affa6389f667adb909e1d524dc43c5b41bfcefcb0e36841fca9c1629bee47ee39b3283fb28199085ca
SHA1 hash: 144822f2f3271a235c19817566dad690b17b134b
MD5 hash: 671eab4f65e6b05993baa322ffd72597
humanhash: georgia-colorado-music-failed
File name:Purchase Order_pdf.exe
Download: download sample
Signature Pony
Create hunting rule
File size:633'856 bytes
First seen:2020-06-16 05:43:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 54460d2eedb6a541ae3fa68cd3e66377 (10 x Loki, 8 x AgentTesla, 4 x NanoCore)
ssdeep 12288:8n5WrxQ9hwM0cqsdxGAukR6E2F6Be8nAOXDpyY1Jx:mQrx8h9Osdgk72wJ/4Y1H
Threatray 127 similar samples on MalwareBazaar
TLSH F5D49F22E2D04437C1E7363D9F4B9674AC2BBA132D286D466FE4CD0C9F396823967197
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: slot0.mcleeria.com
Sending IP: 45.95.169.81
From: WEBB-STILES COMPANY <info@mcleeria.com>
Subject: NEW PO 0111146 PUR-1533
Attachment: Purchase Order_pdf.exe

Pony C2:
http://shinhan-vina.com.vn/hd/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Fareit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10611/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.GenKryptik.EMFN.12147.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:45:08 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wvn4lpsoe2ktwuioannkuh4cdov7j5sb5aykqdrx72gwxi2pvmuq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
044ead01325ba352582421e78cce54811b6075e28486a8d1f4a9542da786f228
Pony
23e3757121ff1a0c053d2dc66651ad8e2152373724a8091c56a7fae203401cab
Pony
40bcf1b92cac08e72eb025659bb892a41926ebd655f448ff5544ece312986987
Pony
49f23a6aa07ad1617e09d06680a7e2544ba8daa9295285405b7c82ab96b8a335
Pony
80b9257f924aef8ac5a1a724234ddcd6b67bee79819202bb7b5d4586b35164c7
Pony
82c531ee47fd52c78ed90b259be7908208ae6657a75643fce70df85eb0cd64a3
Pony
98adccc8a599f53904c5cd22c7398d6b692c642807cab71f1ab6d2dc65e1c5a5
Pony
be2574eff410b1b63255c93f82e398c50b7af0f7431786e49b1dc922fbb5a910
Pony
f711673ec31f884e59192cc360b841efc1c77b0d0b41787bea5424ae520f9989
Pony
fe966a744b83daaecb2b4b01adc7204e42d3f98955e142e78d7a948709185d27
Pony
+ 117 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer
Link:
https://tria.ge/reports/201109-6nmwh7sh2n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

Executable exe b55bc5be4e26953b510e035aaa1f821babf4f641e830a80e37fe8d6ba34fab29

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10611/

Comments