MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40fc1e6f956763871d70c576634c8444713283d44cb09048b1d451d0f1f6207e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40fc1e6f956763871d70c576634c8444713283d44cb09048b1d451d0f1f6207e
SHA3-384 hash: db95ec5eec4cc575907dfaaabba25e58395aad94bf5663bc83d8f4f247d4d6fe6f7149a9cba5293a3ada7de4eb199b69
SHA1 hash: 459c67aed9dc0db4ba09da829c4ddeb439288ae0
MD5 hash: 27877263ae03dd2d0290433e7e970c98
humanhash: tennessee-delaware-december-rugby
File name:Oplata ponedelnik.001
Download: download sample
Signature Pony
Create hunting rule
File size:129'845 bytes
First seen:2020-07-13 11:09:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:j31/jxwB6WjDAf5vMsUYWDvNJcO/Fu2HnquMNIp:j31/CLoPIFu2nMK
TLSH 05C312B172DAF7A7690E0860F452B9001D95FBF661481D709709B7833E68B1E12FEDB2
Reporter abuse_ch
Tags:001 geo Pony RUS


Avatar
abuse_ch
Malspam distributing Pony:

HELO: mail.president-hotel.by
Sending IP: 178.159.46.103
From: Виктория Савельева <spa@president-hotel.by>
Reply-To: Виктория Савельева <tarasovaek60@rambler.ru>
Subject: =?utf-8?B?0KDQsNGB0YfQtdGCINC90LDRh9Cw0LvQviDQuNGO0LvR?==?utf-8?B?jw==?=
Attachment: Oplata ponedelnik.001 (contains "Oplata ponedel'nik.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
798
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40fc1e6f956763871d70c576634c8444713283d44cb09048b1d451d0f1f6207e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:11:04 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=id6b434vm5ryohlqyv3ggteeirytfa6ujsyjasfr2ri5b4pweb7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar 40fc1e6f956763871d70c576634c8444713283d44cb09048b1d451d0f1f6207e

(this sample)

Pony

Executable exe d06be7bd36b4cdd6ac12e3c7fb675515cd33ae9ea75a26e7dc7fc3a7db14caff

  
Dropping
MD5 9a4c7ae4bcaa653ffd966d17785ed92d
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d06be7bd36b4cdd6ac12e3c7fb675515cd33ae9ea75a26e7dc7fc3a7db14caff

Comments