MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dba22bb151cb9c5e35304b1a6215374d6857898d217b721f9b5a6e8d973576d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2dba22bb151cb9c5e35304b1a6215374d6857898d217b721f9b5a6e8d973576d
SHA3-384 hash: 3e5e2a2ba129cc7c48f14db9733e50a0bb7ba43a843cf6b190b1adea65bb74ecd993bae15780021e89070e39a9fc0409
SHA1 hash: f772b105b8a7c295bfb0452615cac79935263808
MD5 hash: f6613859705e6c8093b0156f6b3e9b26
humanhash: lithium-orange-timing-montana
File name:infodayclubhai.com__igna.exe
Download: download sample
Signature Pony
Create hunting rule
File size:663'552 bytes
First seen:2020-03-18 18:12:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ebab414c35f6dac3cd04c27cc9eceba6 (1 x Pony)
ssdeep 12288:2/lyCqxcpOhAqmwRclr3Ue+JAUlpldJkSj0GGmTLVdDF2Iqm/1Y2ZeyMh8Uw:2/YxcpOhAqmwRcB3Ue+JAUlpldJkSj0u
Threatray 733 similar samples on MalwareBazaar
TLSH B0E46B6056CB9A3FEF5B4873311489B9D270ED52A58CB8743EC4B79623FE3AB5C54202
Reporter ov3rflow1
Tags:exe Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Fareit-6780990-0
Create hunting rule

Win.Trojan.Gamarue-7088569-0
Create hunting rule

Win.Trojan.Fareit-7101834-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2018-04-11 07:59:38 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
5e57e98ff9180e08404e1ddaf29e274ab4df1149b2cbfbdf3422ae460afbafac
Pony
754b203cb7ca6224a217e4187151adb437574b95fe15fd1bb7ab887cffad8bce
Pony
78c42daa9bd978e2e2ca039a54f167f5090681124f402fa9c9bd69a2dd23bc26
Pony
9026e9b714998846a26087ed7f5a276b1399204a1e34d469571a7301ce720931
Pony
9d6db09dd795c7571aa27604483c0875da0c2a8b1501e6c4d34093b38da06ea2
Pony
a8af98897cc2adfa6868c15ad536d7359f749ff3bb8cf9be11c7e45d437dc37f
Pony
aba89c003bab6d64d5f68c470122707e3ee14d220931315d39b8f4d04135c56f
Pony
d9f43f0b6e44588cc526f36493bbbec4b49da176395e4a55ff9373d573593077
Pony
da6a5a35ad94ccafa9da5cf5579033e0df382f567eed47793141ed511c8f2920
Pony
f79be9655ab5fa236f5b81bc4af8538e91e4dbb3f6ee25d14891c6bec26681ae
Pony
+ 723 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2dba22bb151cb9c5e35304b1a6215374d6857898d217b721f9b5a6e8d973576d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/4299/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments