MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f714e3333a97412e38b5094aec338dd3900c94eaf835a4b0aa89db3ff9ef47f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f714e3333a97412e38b5094aec338dd3900c94eaf835a4b0aa89db3ff9ef47f
SHA3-384 hash: 8bc4ace86ec0f5f84459f7f1a16e8ef55abcfbf0b61c6d92ae7aab8d476f3e21200754a68f967eb97f813a372c2923e0
SHA1 hash: a32c80203e894600a8133960a2f9c570600193e6
MD5 hash: 3ca5230c19df77a8fdc7aec2589196e6
humanhash: violet-ceiling-march-iowa
File name:PROFOMA INVOICE_PDF.iso
Download: download sample
Signature Pony
Create hunting rule
File size:933'888 bytes
First seen:2020-08-03 14:12:36 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:LhbK4CqfrwCEGafFT6eVQpEOX4TX4AOiBeg2ge:1blCcZ4FTFqrX4j4AL
TLSH E5154A6E2EFE4D2FD2A58F3928B343191EEC9CD7E816D76725E4336C0671BA815C0A11
Reporter abuse_ch
Tags:iso Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: WIN-9KJ2BKFSND1
Sending IP: 185.222.57.234
From: Ms. Phitchaya <support@ac-dubai.ae>
Subject: PROFOMA INVOICE NO: 2020TD24
Attachment: PROFOMA INVOICE_PDF.iso (contains "PROFOMA INVOICE_PDF.exe")

Pony C2:
http://brokenservices.ga/Slyp/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
745
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f714e3333a97412e38b5094aec338dd3900c94eaf835a4b0aa89db3ff9ef47f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 04:58:37 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5yu4mztvf2bfy4lkckk5qzy3u4qbskov6bvusykvco3h7466r7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1f714e3333a97412e38b5094aec338dd3900c94eaf835a4b0aa89db3ff9ef47f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

iso 1f714e3333a97412e38b5094aec338dd3900c94eaf835a4b0aa89db3ff9ef47f

(this sample)

Pony

Executable exe e2d51d5dea8e3b54091d4575a79b4a535cd201404048f77045c06cd57e79a637

  
Dropping
MD5 4f5e3991a355f267377ea27e89f4d5f4
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2d51d5dea8e3b54091d4575a79b4a535cd201404048f77045c06cd57e79a637

Comments