MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25fed751b0f20145c23eb26c5e50b4aa7117ef2245fc2fef5b9fb2a8c266b373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25fed751b0f20145c23eb26c5e50b4aa7117ef2245fc2fef5b9fb2a8c266b373
SHA3-384 hash: 98094eaabf824c68e31d85526d484f45e46940c728c90ef28e17b9dc935cf40c37a8c9522bcad35b36d744bbbb7aa3f7
SHA1 hash: 6ed6a360e3f8c6b08235702b706b0fccfd8e62a6
MD5 hash: 19ddb9279e2ba80559483fe1e630a735
humanhash: hawaii-delta-spring-robert
File name:DC10669574.doc.powerpoint.iso.zip
Download: download sample
Signature Pony
Create hunting rule
File size:208'551 bytes
First seen:2020-07-09 18:33:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:QOAcXJReLaO2iPbLboj+eawPLvWuipidZmbEu2j9LF6PeWpjCqSbqECAqkCCWy2f:Q7mJ8G0PcjJCuipcmbe5s2ajVSc4sU8
TLSH 6D1422C0580C97EF25153272962890D6D7CEB091A4E23070F8BFD66E1EB8EE5974C7C9
Reporter abuse_ch
Tags:Pony zip


Avatar
abuse_ch
Malspam distributing Pony:

HELO: server.kardoshost.com
Sending IP: 192.210.150.19
From: Τμήμα Δικτύων - Διαδικτύου (ΤΔΔ) <import@bbngroup.org>
Subject: Payment Advice Note.
Attachment: DC10669574.doc.powerpoint.iso.zip (contains "DC10669574.doc.powerpoint.exe")

Pony C2:
http://kanavagronomy.in/star/panel/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
784
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25fed751b0f20145c23eb26c5e50b4aa7117ef2245fc2fef5b9fb2a8c266b373/
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 18:35:04 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ex7nounq6iaulqr6wjwf4ufuvjyrp3zcix6c7323t6zkrqtgwnzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

zip 25fed751b0f20145c23eb26c5e50b4aa7117ef2245fc2fef5b9fb2a8c266b373

(this sample)

Pony

Executable exe d1b6aaf16fc5e9ffbe13411dfbefe5c0c7dd222c727852da8fc9fb39a88ed2ae

  
Dropping
MD5 514933d5240f64e160a245027dcf73ff
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d1b6aaf16fc5e9ffbe13411dfbefe5c0c7dd222c727852da8fc9fb39a88ed2ae

Comments