MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed
SHA3-384 hash: baeea689ccb413b57d32901f8050392260210076a18b176e722f232be87d1b8cd1a668db46684f0cc85278ef17beaabf
SHA1 hash: eea1d63f741a0ec57de41e614f0034b3fcd618bc
MD5 hash: 4d988f8d4b1035abcb2eb4eb4e498b19
humanhash: eighteen-india-fruit-apart
File name:c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed
Download: download sample
Signature Pony
Create hunting rule
File size:139'776 bytes
First seen:2020-11-14 18:24:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be19e18d6a8b41631d40059031a928bb (28 x Pony, 3 x Loki, 3 x NetWire)
ssdeep 3072:zoTv/p/6pTho4yEPhXzpqq/c+tPtdHVWcS:8Tn4o4yKzb/ztV
Threatray 3'115 similar samples on MalwareBazaar
TLSH A5D3126920CC0468D44ED83158E69EE2F36FADC0882D597B1FE2FF277A75A0A1472934
Reporter seifreed
Tags:Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
456
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

Win.Malware.Fareit-9790210-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Reading critical registry keys
DNS request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/535257
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Lokibot Info Stealer
Detected unpacking (changes PE section rights)
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Generic Dropper
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 316728 Sample: wL4juEWzFw Startdate: 15/11/2020 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Multi AV Scanner detection for domain / URL 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 6 other signatures 2->49 9 wscript.exe 1 2->9         started        11 wL4juEWzFw.exe 3 2->11         started        process3 file4 15 filename.bat 9->15         started        37 C:\Users\user\AppData\...\filename.bat, PE32 11->37 dropped 57 Detected unpacking (changes PE section rights) 11->57 59 Detected Lokibot Info Stealer 11->59 61 Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code 11->61 63 Tries to steal Mail credentials (via file registry) 11->63 18 wL4juEWzFw.exe 1 14 11->18         started        21 MpCmdRun.exe 1 11->21         started        signatures5 process6 dnsIp7 65 Antivirus detection for dropped file 15->65 67 Detected unpacking (changes PE section rights) 15->67 69 Detected Lokibot Info Stealer 15->69 73 3 other signatures 15->73 23 filename.bat 14 15->23         started        39 myp0nysite.ru 194.67.71.89, 49683, 49686, 80 AS-REGRU Russian Federation 18->39 71 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->71 27 cmd.exe 1 18->27         started        29 conhost.exe 18->29         started        signatures8 process9 dnsIp10 41 myp0nysite.ru 23->41 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->51 53 Tries to harvest and steal ftp login credentials 23->53 55 Tries to harvest and steal browser information (history, passwords, etc) 23->55 31 cmd.exe 1 23->31         started        33 conhost.exe 27->33         started        signatures11 process12 process13 35 conhost.exe 31->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:29:17 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ya7dxtsxe6inpthsrs5ajelrr6twggutcas27bukqf3c36mdyhwq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
59c17773776261d45122a0d067088654268ca71b329a6e9495105c500c12c8c1
Pony
5a8239ffd5e37023816296c83bf64261d7461cc373669a881a1b2284d767d1ed
Pony
5dbfd22543849bd392e080c351227f31137993f23ee7ac5a3184322e43d73745
Pony
68629701b12d1300254ce04807b894fd8195bd36ce6b6ceebe5beba5d60cf5d3
Pony
757031344cc71050e625abd7d6e413e07c506d539f834835413ca1b656898b34
Pony
93e31993de213880948286b0b8d7246d5870a234307d94e799170357074a4e83
Pony
948b5d4daa9864aae1297b9481a1bcee316f723af481e983dbff09fcd8a24563
Pony
9e7bc04d9b7a15b73175902e3c8cd0f245353bb88dfe0a68d122616255aed42f
Pony
b3aac3c1fed205d6c1e36f80475cdb4b243f6fb7b2d275f360867aa6dcec5fe8
Pony
e06424448f76d743640e518b0fec78a025fee0856f6afa507e077e5dcc118e3c
Pony
+ 3'105 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201114-nve8dxxg1a/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed
MD5 hash:
4d988f8d4b1035abcb2eb4eb4e498b19
SHA1 hash:
eea1d63f741a0ec57de41e614f0034b3fcd618bc
Link:
https://www.unpac.me/results/37b8c852-029b-45b8-afbb-4931b2129a70/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c03e3bce572790d7ccf28cba0491718fa7631a931025af868a81762df983c1ed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments