MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5fa035dcf98f4001cb799409a1aacabe54b7d26f570c26d747825928fbbfa52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5fa035dcf98f4001cb799409a1aacabe54b7d26f570c26d747825928fbbfa52
SHA3-384 hash: 731cd78b4569b3f3937ee1401b32ebc1746826420f5ab3800b19c42c1c21e7774d5713a7164d0cb2973495e6e0808054
SHA1 hash: 88340179f3aa73124bee96afc0c3733edf4a51e5
MD5 hash: 1f4deb2eb175974a189a63f5b2aec722
humanhash: seven-william-three-coffee
File name:REV-INV8796E425.rar
Download: download sample
Signature Pony
Create hunting rule
File size:250'074 bytes
First seen:2020-08-05 08:02:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:COWRN3A/xU9oiTTCGaNsw2G7M2Ym+oWaIUr5NRYTeu5nFuzMI9uR3f:M3Wx74TCNNsDG42aa5rLRuvxFuIGuN
TLSH 623423977C142F459149EA3CC16E7BB8CADE0DB5093D98C28938B6B54B06F9193BF9C0
Reporter abuse_ch
Tags:Pony rar


Avatar
abuse_ch
Malspam distributing Pony:

HELO: gmail.com
Sending IP: 81.171.9.143
From: BBI <puneet.minocha@bbmiuae.com>
Reply-To: BBI <surnit9041@gmail.com>
Subject: REVISED INVOICE & DO
Attachment: REV-INV8796E425.rar (contains "REV-INV8796E425.exe")

Pony C2:
http://www.bonanzadesign-my.com/grace/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
735
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5fa035dcf98f4001cb799409a1aacabe54b7d26f570c26d747825928fbbfa52/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:04:06 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yx5agxoptd2aahfxtfajugvmvpsuw7jg6vyme3lupaszfd537jja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c5fa035dcf98f4001cb799409a1aacabe54b7d26f570c26d747825928fbbfa52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar c5fa035dcf98f4001cb799409a1aacabe54b7d26f570c26d747825928fbbfa52

(this sample)

Pony

Executable exe 9d6db09dd795c7571aa27604483c0875da0c2a8b1501e6c4d34093b38da06ea2

  
Dropping
MD5 4383a83bec5376131a466be2be9e2324
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d6db09dd795c7571aa27604483c0875da0c2a8b1501e6c4d34093b38da06ea2

Comments