MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 434ca2abe800c7c8fb1c39f3a298a69bb63f36821ceb5ec064ae45bae48b5637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 434ca2abe800c7c8fb1c39f3a298a69bb63f36821ceb5ec064ae45bae48b5637
SHA3-384 hash: eb8cd4b71fa01b54f208c7cca547cde358bc0e2fbc5c82ac2bb6613a6d12373452a5e3a779f40b2f5b8878592742d7fd
SHA1 hash: d75f1acb0d8af575d41d6b0a8568e2f905907e31
MD5 hash: a8a155a3bc3d4eab28014c56ba315868
humanhash: triple-colorado-glucose-eight
File name:SHIPPING-DOC0292.rar
Download: download sample
Signature Pony
Create hunting rule
File size:250'228 bytes
First seen:2020-08-06 05:47:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:aSR6fkPV/qw9C5JgtnMVaXyy8ihjuIhKTZZtDCl:aM6sPFgTgx+2yy8i0WgZZtDi
TLSH BF342395667A340590EBADCFE1B03B3494E5BA43770BB450BC3812B554F7CA902B1BEE
Reporter abuse_ch
Tags:Pony rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gmail.com
Sending IP: 81.171.9.143
From: 조미선(Cho Misun) <chomi0605@panpacific.co.kr>
Reply-To: BBI <surnit9041@gmail.com>
Subject: VESSEL B/L NO : ELCKSEL20070292 SHIPPING DOC
Attachment: SHIPPING-DOC0292.rar (contains "SHIPPING-DOC0292.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
741
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/434ca2abe800c7c8fb1c39f3a298a69bb63f36821ceb5ec064ae45bae48b5637/
Threat name:
ByteCode-MSIL.Trojan.Hesv
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:49:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ingkfk7iadd4r6y4hhz2fgfgto3d6nucdtvv5qdevzc3vzelky3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/434ca2abe800c7c8fb1c39f3a298a69bb63f36821ceb5ec064ae45bae48b5637

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar 434ca2abe800c7c8fb1c39f3a298a69bb63f36821ceb5ec064ae45bae48b5637

(this sample)

Pony

Executable exe d9f43f0b6e44588cc526f36493bbbec4b49da176395e4a55ff9373d573593077

  
Dropping
MD5 0a03a6707115291e4f657aca91b85446
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9f43f0b6e44588cc526f36493bbbec4b49da176395e4a55ff9373d573593077

Comments