MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d01f1ad8b4e08a70621ab7d9907d551bc238a990737e45060252998c059bb0fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d01f1ad8b4e08a70621ab7d9907d551bc238a990737e45060252998c059bb0fa
SHA3-384 hash: 5554a22a9da2aa42d1ba0ee5304647bcdaff5bc3c362f255b6ae74e17723f5b65d56418da54b1316340c9d7d7bf99644
SHA1 hash: afc88adea76fe44926cfabc2e3069b19c1f1512c
MD5 hash: 629c9c91515c950d1d175e8b607f3f74
humanhash: oklahoma-quebec-mississippi-monkey
File name:SHIPPING DOCUMENT_PDF.exe
Download: download sample
Signature Pony
Create hunting rule
File size:951'808 bytes
First seen:2020-08-05 08:31:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:CiXBDlMJehHpsCeledvBdWgClzdudo61uh7sDJVsQwd29VQ44iLeIHoplaxwkZZl:zkVhO5c7+HV71kzgTctpwKpw
Threatray 147 similar samples on MalwareBazaar
TLSH 9915CE6129C8DFE4D97E07353C237840ABF2BD059B20EE0DFD9171AD1A72A854A36B1D
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From: MAERSK LINE <jkkang@ptjlg.co.id>
Subject: TOP URGENT : Outstanding Import Invoice // Need urgently settle by August 5th, 2020 // CNEE // BL AAGS030552
Attachment: SHIPPING DOCUMENT_PDF.gz (contains "SHIPPING DOCUMENT_PDF.exe")

Pony C2:
http://smkrantimula.sch.id/ol/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
418
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39213/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Reading critical registry keys
DNS request
Connection attempt
Sending an HTTP POST request
Running batch commands
Stealing user critical data
Enabling autorun by creating a file
Brute forcing passwords of local accounts
Result
Threat name:
Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/410579
Signature
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257558 Sample: SHIPPING DOCUMENT_PDF.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 30 Malicious sample detected (through community Yara rule) 2->30 32 Sigma detected: Scheduled temp file as task from temp location 2->32 34 Yara detected AntiVM_3 2->34 36 9 other signatures 2->36 8 SHIPPING DOCUMENT_PDF.exe 7 2->8         started        process3 file4 22 C:\Users\user\AppData\Roaming\njlPcsx.exe, PE32 8->22 dropped 24 C:\Users\user\...\njlPcsx.exe:Zone.Identifier, ASCII 8->24 dropped 26 C:\Users\user\AppData\Local\...\tmpE467.tmp, XML 8->26 dropped 28 C:\Users\...\SHIPPING DOCUMENT_PDF.exe.log, ASCII 8->28 dropped 11 SHIPPING DOCUMENT_PDF.exe 1 14 8->11         started        14 schtasks.exe 1 8->14         started        process5 signatures6 38 Tries to harvest and steal ftp login credentials 11->38 16 cmd.exe 1 11->16         started        18 conhost.exe 14->18         started        process7 process8 20 conhost.exe 16->20         started       
Detection:
pony
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d01f1ad8b4e08a70621ab7d9907d551bc238a990737e45060252998c059bb0fa/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 05:17:50 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2aprvwfu4cfhayq2w7mza7kvdpbdrkmqon7ekbqckkmyybm3wd5a._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
1c85e967c0c5b4a332aabcec26d9df72c5a3e959f317ebe08202671e3ec254ec
Pony
38eb441454dd6b9459981660281d748fc8d5052a07b15597d317a3fec3b72400
Pony
5568021e42a81a2755fd6d968efa50b13f99a9997d8973097231079de84832ad
Pony
760dd5e8864e9c94296e285f17ce5b67c9c36d462cd301fa5a72e20b6c97df33
Pony
78bb05f8287c0a41174d810b2e9954b3010b523777ba521ba8336219501bded4
Pony
b1dfcf175d2aeff612c4aada38df796c1f4687caacd0b26e02f66485d5a32899
Pony
b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd
Pony
b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f
Pony
d44ec72ea7ed650ad5ae4102ef8b60397673335a4471f2537cf6f5933cc8bf49
Pony
d826e50de7b11772bc48d32d0f75b72a7975e469cfe9583a51edbd9bbaa58387
Pony
+ 137 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
discovery rat spyware stealer family:pony
Link:
https://tria.ge/reports/200805-ms849jfj5a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d01f1ad8b4e08a70621ab7d9907d551bc238a990737e45060252998c059bb0fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

gz 7ad6094872144c24ef1ca5c222c747b52e7046713ea79a588e1bcab07a1dd0f0

Pony

Executable exe d01f1ad8b4e08a70621ab7d9907d551bc238a990737e45060252998c059bb0fa

(this sample)

  
Dropped by
MD5 031517f8d36a5edd507cb7c22ffff7ea
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39213/
  
Dropped by
SHA256 7ad6094872144c24ef1ca5c222c747b52e7046713ea79a588e1bcab07a1dd0f0

Comments