MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017
SHA3-384 hash: d8c0e5d117c5bd35dbf5548ddccb1d4ab4e72aede55639e23bdf2b482c21375d1809bc13396baedf506c5c050a354a6e
SHA1 hash: 99f75e2655c1091a2ae0617a3bd4656ca78ac266
MD5 hash: bc3a19993b5b3904b71b72d0282ba83d
humanhash: happy-april-earth-california
File name:BC3A19993B5B3904B71B72D0282BA83D.exe
Download: download sample
Signature Pony
Create hunting rule
File size:103'961 bytes
First seen:2025-01-17 07:20:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ca1c0dce7ff929cddd01037919de7b9 (1 x Pony)
ssdeep 1536:YxMjdTMU+O8h7jiTqjOR6/Br1BvT9Dys7W4/O3cEbpk6TsPr0Sm9JIXachUDVxm8:YWiUlzR61zDITKusTBkIqchOTD
TLSH T1FAA3CFFC7157BC35E903AA3120B6F41804255E223F5AE13D2856757C8BB6F82318AEAD
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon e8dc888898a88490 (1 x Pony)
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Pony C2:
http://chellebelledesigns.com/ponyb/gate.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://chellebelledesigns.com/ponyb/gate.php https://threatfox.abuse.ch/ioc/1384768/

Intelligence

File Origin
# of uploads :
1
# of downloads :
431
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
pony
Create hunting rule
ID:
1
File name:
BC3A19993B5B3904B71B72D0282BA83D.exe
Verdict:
Malicious activity
Analysis date:
2025-01-17 09:00:58 UTC
Tags:
fareit pony stealer trojan
Link:
https://app.any.run/tasks/de45ee05-10e7-4ee9-8f6a-86bda2738d0f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.3243.12590.19113.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678a04e14487910100dfb955
Tags:
fareit lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Reading critical registry keys
DNS request
Connection attempt
Sending an HTTP POST request
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
crypt microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/678a04dea364b83b70a6b2f7/reports/84f93c89-81fe-459b-bea6-a8a9a40d5b23/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017
Malware family:
Pony
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ea6d9c2-fc0f-4be0-b3b0-bdc4057bcbcc
Result
Threat name:
Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1593443
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017
Detection:
pony
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017/
Threat name:
Win32.Infostealer.Zeus
Create hunting rule
Status:
Malicious
First seen:
2025-01-08 18:46:35 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlauviouai45mntnwhjoe5l7277ovlu7gvcdqwzh3g7jfsrbgalq._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
error
Pony
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony collection credential_access discovery rat spyware stealer
Link:
https://tria.ge/reports/250117-h6m51sxlal/
Behaviour
Suspicious use of AdjustPrivilegeToken
outlook_win_path
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks installed software on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Pony family
Pony,Fareit
Malware Config
C2 Extraction:
http://chellebelledesigns.com/ponyb/gate.php
http://1800callabe.com/ponyb/gate.php
http://1866callabe.com/ponyb/gate.php
http://abemoussa.com/ponyb/gate.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/065a3ea1-38b9-4921-8d52-b4ddc22e85e4
Unpacked files
SH256 hash:
ceacf00ae2e5e8fc899c40884d5cfc3284d138e6e68d6d88aa4e24a460da0d05
MD5 hash:
9abe2ff788631e905dcc54194140e49a
SHA1 hash:
dc8604228f26d7e199a4d31f3a1ad3da748e5d2c
Detections:
win_pony_auto
Create hunting rule
win_pony_g0
Create hunting rule
malware_windows_pony_stealer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Link:
https://www.unpac.me/results/b8b2c3a3-c4f1-40f2-8fce-75b03e52e1ff/
SH256 hash:
4ac14aa1d40239d6366db1d2e2757fd7feeaae9f3544385b27d9be92ca213017
MD5 hash:
bc3a19993b5b3904b71b72d0282ba83d
SHA1 hash:
99f75e2655c1091a2ae0617a3bd4656ca78ac266
Link:
https://www.unpac.me/results/b8b2c3a3-c4f1-40f2-8fce-75b03e52e1ff/
Malware family:
Pony
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4ac14aa1d402/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Fareit
Create hunting rule
Author:kevoreilly
Description:Fareit Payload
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pony
Create hunting rule
Author:Brian Wallace @botnet_hunter
Description:Identify Pony
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Pony_d5516fe8
Create hunting rule
Author:Elastic Security
Rule name:win_pony_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW

Comments