MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pony

Vendor detections: 18

Intelligence 18 IOCs YARA 11 File information Comments

SHA256 hash:	0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c
SHA3-384 hash:	b4d3e0508e5cee70bc7d8d825d07046b432c792d8c123db7dba38d72474d30b442e8d9fff8d4ede1985f9155359ba5d4
SHA1 hash:	6a13bc929eea9d9b0b11478cd2b29386b1df5d37
MD5 hash:	0ed7d62fc09814ce1f8f7b3b88b8a081
humanhash:	emma-timing-hawaii-music
File name:	0ed7d62fc09814ce1f8f7b3b88b8a081.exe
Download:	download sample
Signature	Pony Create hunting rule
File size:	66'419 bytes
First seen:	2024-03-11 05:20:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	88318d0a74542a043a5bad06ad4fd2a7 (1 x Pony)
ssdeep	1536:zzq+5hRpfv07XCH8mIahlh/EoP9fJtfG+v/kjC/ExN49ZPFfq8mJ:ECGahZJtfG+9E2ZPQ
Threatray	109 similar samples on MalwareBazaar
TLSH	T1B853D00FF2819E67E4109531657B46799E35DA0583309BC3BFCCDC227B722D1A67B88A
TrID	25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 19.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.1% (.EXE) Win32 Executable (generic) (4504/4/1) 7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) 7.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	b48aeab8b49496ca (1 x Pony)
Reporter	abuse_ch
Tags:	exe Pony

abuse_ch

Pony C2:
http://criminallawdc.com/default.php

Intelligence

File Origin

# of uploads :

# of downloads :

378

Origin country :

Vendor Threat Intelligence

Malware family:

pony

ID:

File name:

0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c.exe

Verdict:

Malicious activity

Analysis date:

2024-03-11 05:25:15 UTC

Tags:

fareit pony trojan stealer

Link:

https://app.any.run/tasks/d13c02e3-1e0f-42a4-940e-a87b88bc6c76

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Pony

Link:

https://www.capesandbox.com/analysis/478466/

Detection(s):

SecuriteInfo.com.SHeur4.BFTA.8265.27859.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Restart of the analyzed sample

Reading critical registry keys

DNS request

Connection attempt

Sending an HTTP POST request

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

Sending an HTTP GET request

Forced system process termination

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

jorik karagany overlay packed zbot

Link:

https://www.filescan.io/uploads/65ee94be5cd908a33dae34f6/reports/55dd9a5e-4daa-4912-a2a2-d8a3a7817908/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c

Malware family:

Pony

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ac754092-737c-4e38-ac45-6d1dfb069165

Result

Threat name:

Pony

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1406318

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c

Detection:

pony

Link:

https://mwdb.cert.pl/sample/0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c/

Threat name:

Win32.Trojan.Zeus

Status:

Malicious

First seen:

2013-04-08 16:57:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 38 (78.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=arimpzwecotdv5d4ar2krkhy4dddywwn6cmlrzqz6q35bt2nqkoa._file

Verdict:

malicious

Label(s):

pony

Pony

1806d28090fbacfecd7f998105128105b92830e971b79948697a3f0210ee30bc

Pony

8feae03951203fbfdf623c8dfadad2cdc10560bc11e28c1fc134492a764833a6

Pony

9378e9d06e62026de1c1769a92841cbc953f0d66843a1920e731ca76913d89de

Pony

de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6

Pony

f88de8b3ada41e2dd897a08968021b048ec433d375910cecfc277dbb9d6f2cbb

Pony

+ 99 additional samples on MalwareBazaar

Result

Malware family:

pony

Score:

10/10

Tags:

family:pony collection discovery rat spyware stealer upx

Link:

https://tria.ge/reports/240311-f1zwhscf95/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

UPX packed file

Pony,Fareit

Malware Config

C2 Extraction:

http://criminallawdc.com/default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh
http://1callalert.com/default.php?qA6UBcu6AjB8x9JqvOtC3aBFoTU5C21aEDB34
http://semtly.com/default.php?8xRRepn5vWSVMvIgKDkgQwCMvQZR6bUhD9vdP1U9P
http://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6
http://e3pos.com/default.php?SltKWD44EdkECNMISztnGyO3arr5mRG6rjiVzFkw1V

Unpacked files

SH256 hash:

feec3700f32c1e0c01e0357ed29a5d4ca16f58b755a53a20e3f41556390d6eca

MD5 hash:

a58d6e3222f809f739c3853680517ec8

SHA1 hash:

b92949d85e161fc4b93ec4a051906ab251260f65

Detections:

win_pony_auto

win_pony_g0

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

malware_windows_pony_stealer

Link:

https://www.unpac.me/results/775f6c96-ba49-437e-bb25-daafe3b2d2e0/

SH256 hash:

0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c

MD5 hash:

0ed7d62fc09814ce1f8f7b3b88b8a081

SHA1 hash:

6a13bc929eea9d9b0b11478cd2b29386b1df5d37

Link:

https://www.unpac.me/results/775f6c96-ba49-437e-bb25-daafe3b2d2e0/

Malware family:

Pony

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0450c7e6c413/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Farheyt

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pony Create hunting rule
Author:	Brian Wallace @botnet_hunter
Description:	Identify Pony

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	UPX20030XMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_Pony_d5516fe8 Create hunting rule
Author:	Elastic Security

Rule name:	win_pony_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/478466/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample