MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2676001820bcebef4300cbf951a4b5972516a817763c1b950b0be08b73786022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2676001820bcebef4300cbf951a4b5972516a817763c1b950b0be08b73786022
SHA3-384 hash: e835ac8e9dea5fee6b8d2e2a6a17ee164e87c635c578a9a2134764efa8b0543c28ac4c886cc842f13dd6c9ef7cd8c601
SHA1 hash: 5edd51c64ae27a3a78bdbc0597b94202ed7222b7
MD5 hash: 4ccc1b4425eb6a447fce29acc0191899
humanhash: spaghetti-oranges-fix-carpet
File name:HSBC PAYMENT ADVICE.pdf.gz
Download: download sample
Signature Pony
Create hunting rule
File size:314'557 bytes
First seen:2020-08-19 11:18:41 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:dBiw9FGunJJoKFWuTQ531PGJGdu38CqJdyyglZGbNeBekTMZkl:zisGsWKFWnP9du38jJdo5Xl
TLSH 6E642364A0E91C6C1FAD1CB2CC63D4F143DB171E954A09A88C59F291E77E1BB3D2A6C3
Reporter abuse_ch
Tags:gz HSBC Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: mail.ptjlg.co.id
Sending IP: 103.253.68.52
From: HSBC BANK <jkkang@ptjlg.co.id>
Reply-To: HSBC BANK <tongsaetumg@gmail.com>
Subject: HSBC Beneficiary Payments Advice
Attachment: HSBC PAYMENT ADVICE.pdf.gz (contains "HSBC PAYMENT ADVICE.pdf.exe")

Pony C2:
http://logix.co.za/wp-admin/xox/panelnew/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
901
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27281.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2676001820bcebef4300cbf951a4b5972516a817763c1b950b0be08b73786022/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 02:02:13 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ez3aagbaxtv66qyazp4vdjfvs4srnkaxoy6bxfilbpqiw43ymara._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2676001820bcebef4300cbf951a4b5972516a817763c1b950b0be08b73786022

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

gz 2676001820bcebef4300cbf951a4b5972516a817763c1b950b0be08b73786022

(this sample)

Pony

Executable exe 855e85de489ded4ca8e543cb8323c2d91e88c0e9d6ffe1c490f6133190c4d6c5

  
Dropping
MD5 b3fcf05b7908ab6034da4165da614391
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 855e85de489ded4ca8e543cb8323c2d91e88c0e9d6ffe1c490f6133190c4d6c5

Comments