MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe966a744b83daaecb2b4b01adc7204e42d3f98955e142e78d7a948709185d27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe966a744b83daaecb2b4b01adc7204e42d3f98955e142e78d7a948709185d27
SHA3-384 hash: b653581bab59bd758071da3f2e46833f1f5354f09cf28cf9ca57b489d45a5b14c053c9bbe4194a6fcaa707683291f5d4
SHA1 hash: 7b710b3d50f45e1f522341713fa24170454d9f48
MD5 hash: 68a170452e42bcc18b6e91812a08cfc9
humanhash: skylark-pennsylvania-virginia-mobile
File name:POL.exe
Download: download sample
Signature Pony
Create hunting rule
File size:893'952 bytes
First seen:2020-06-12 06:34:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2bf1c4365cee407b2c3a1c3c78c5d36f (11 x AgentTesla, 3 x Pony, 2 x Loki)
ssdeep 12288:UOkBSWyhJEwYQZk6eqphpau3dP7AXC4bQqUwGeWTvFnr1Vu0qxX0UgmU+Y:7iSzviQZk6eqFJUCMG7drS0qeUgm0
Threatray 137 similar samples on MalwareBazaar
TLSH 08157CE2FE934433D17226389D1B5375982ABD102D28D9467BE7CE4E5F3C68239342A7
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: tr.trendapihub.live
Sending IP: 45.95.171.247
From: RASTI LARI GENERAL TRADING CO, LLC <Isaac@preformed.com>
Subject: June Order PO AE76853 / RASTI LARI GENERAL TRADING CO. L.L.C
Attachment: Scan Purchase Order _pdf.zip (contains "POL.exe")

Pony C2:
http://shinhan-vina.com.vn/hd/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Fareit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9085/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.245818.10883.3329.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.CryptInjector
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:36:07 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=72lgu5clqpnk5szljma23rzajzbnh6mjkxqufz4npkkiociylutq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
044ead01325ba352582421e78cce54811b6075e28486a8d1f4a9542da786f228
Pony
23e3757121ff1a0c053d2dc66651ad8e2152373724a8091c56a7fae203401cab
Pony
40bcf1b92cac08e72eb025659bb892a41926ebd655f448ff5544ece312986987
Pony
49f23a6aa07ad1617e09d06680a7e2544ba8daa9295285405b7c82ab96b8a335
Pony
80b9257f924aef8ac5a1a724234ddcd6b67bee79819202bb7b5d4586b35164c7
Pony
82c531ee47fd52c78ed90b259be7908208ae6657a75643fce70df85eb0cd64a3
Pony
98adccc8a599f53904c5cd22c7398d6b692c642807cab71f1ab6d2dc65e1c5a5
Pony
b24205394b92b61e4058e30a94528aa34cf37b3d930c3197d91f33f8fd173cf4
Pony
be2574eff410b1b63255c93f82e398c50b7af0f7431786e49b1dc922fbb5a910
Pony
f711673ec31f884e59192cc360b841efc1c77b0d0b41787bea5424ae520f9989
Pony
+ 127 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer
Link:
https://tria.ge/reports/201109-ngbfyk2ynj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

zip 6f12bec8db3eafacfbdb137ad105da540dc3f33d82e58db54f0b87623d0935d4

Pony

Executable exe fe966a744b83daaecb2b4b01adc7204e42d3f98955e142e78d7a948709185d27

(this sample)

  
Dropped by
MD5 3fe593734899896c94cf67b46e032726
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6f12bec8db3eafacfbdb137ad105da540dc3f33d82e58db54f0b87623d0935d4
Cape
Cape
https://www.capesandbox.com/analysis/9085/

Comments