MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18955e2d542dd4346a452d9fbc6190e657a84ef4019365caf14a4b88339f8d4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18955e2d542dd4346a452d9fbc6190e657a84ef4019365caf14a4b88339f8d4e
SHA3-384 hash: b739b6080f03826255e41b7abd14d76faceab3402fd76638710619c5d5071d14195a5c4756f62aebb3fec23b28c9ce59
SHA1 hash: f5f9f100deb49f2d08c9bc91ba06722bd0a39693
MD5 hash: 28efc59443db9a27fbbd825f769d0641
humanhash: island-early-leopard-blossom
File name:DRAFT BL_pdf.gz
Download: download sample
Signature Pony
Create hunting rule
File size:363'684 bytes
First seen:2020-08-18 12:12:25 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:D6Czvk1UVxqe2qCkurY5WOJyL3KxXBO383oVCEmZEA742tIgBC5/FLAZTavfu0:DRzM1U7qhqiCOLaXBO38VCf2VILwS20
TLSH 09742361DEF4708C98675AA81067E79BBA2ACE9D9D887141479CC087945F30F7823F8F
Reporter abuse_ch
Tags:gz Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: smtpgw3.nayatel.com
Sending IP: 203.82.48.8
From: nidakhan@asd.com.pk
Reply-To: microsoftoutlook19@gmail.com
Subject: RE: BL DRAFT COPY FOR CURRENT SHIPMENT
Attachment: DRAFT BL_pdf.gz (contains "DRAFT BL_pdf.exe")

Loki C2:
http://logix.co.za/wp-admin/xox/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
903
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18955e2d542dd4346a452d9fbc6190e657a84ef4019365caf14a4b88339f8d4e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 01:38:45 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dckv4lkufxkdi2sffwp3yymq4zl2qtxuagjwlsxrjjfyqm47rvha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18955e2d542dd4346a452d9fbc6190e657a84ef4019365caf14a4b88339f8d4e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

gz 18955e2d542dd4346a452d9fbc6190e657a84ef4019365caf14a4b88339f8d4e

(this sample)

Pony

Executable exe 94a85d18a97677231d7c812144d01d3639db1d924aef4c695af4de5811677eb0

  
Dropping
MD5 388c8e7ecb2c43262f177f3ccd7e01ac
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94a85d18a97677231d7c812144d01d3639db1d924aef4c695af4de5811677eb0

Comments