MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 57933bc5c60de83fddbc7a2c6522e6481c9e684e342fed86a4c38bf08c4a6b0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 12
| SHA256 hash: | 57933bc5c60de83fddbc7a2c6522e6481c9e684e342fed86a4c38bf08c4a6b0f |
|---|---|
| SHA3-384 hash: | df1c238edd8992b88151297c254711690db21ea5bfcc8bf55c54f815eb787b4c1c18b3ff5d6cb3993c4549e8612e1f13 |
| SHA1 hash: | 01eea47a0f55b7df7d8275110fa159e5b82be64e |
| MD5 hash: | 63533e07c471cf29ce6fc5887e933494 |
| humanhash: | chicken-thirteen-steak-sad |
| File name: | 57933BC5C60DE83FDDBC7A2C6522E6481C9E684E342FE.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 1'289'885 bytes |
| First seen: | 2021-07-15 17:40:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4b66baab4d4bc19136287649bb7716a2 (1 x Pony) |
| ssdeep | 24576:cWx0LStFoJI75h0LqieDb49HqlfTbByCZTqqi9w:c6uJ2hbYHy0CCw |
| Threatray | 29 similar samples on MalwareBazaar |
| TLSH | T1DF553359C6571481C6C100B31BE3463EE314A9A61B3652C5AB76F70EAFBCB2ED332C56 |
| Reporter |  abuse_ch |
| Tags: | exe Pony |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://www.ptsinar.co/ymg/apisiylo/gate.php | https://threatfox.abuse.ch/ioc/160688/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
652
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
57933BC5C60DE83FDDBC7A2C6522E6481C9E684E342FE.exe
Verdict:
Malicious activity
Analysis date:
2021-07-15 17:43:16 UTC
Tags:
trojan pony fareit stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Fareit
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Lokibot Pony
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected Lokibot Info Stealer
Detected unpacking (changes PE section rights)
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Strictor
Status:
Malicious
First seen:
2018-08-15 06:41:35 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
pony
Similar samples:
+ 19 additional samples on MalwareBazaar
Result
Malware family:
pony
Score:
10/10
Tags:
family:pony discovery evasion rat spyware stealer trojan upx
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Identifies Wine through registry keys
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Pony,Fareit
Malware Config
C2 Extraction:
http://www.ptsinar.co/ymg/apisiylo/gate.php
Unpacked files
SH256 hash:
f0d436a96b7a4d792b6b9993ff120e9017fe58da51432a9a2667204775fd5c8f
MD5 hash:
06cd7d1491cae9c899bf2cd91d72b635
SHA1 hash:
fb047416cdb049b4889ac5551ab56d0fb192e16b
SH256 hash:
c5e3b8d06aa26655ae7777650a490aacbbad1a59276ce32b6704f1f49055e14b
MD5 hash:
c9eb7070a78c3a6cc9cdc1a4f8a35204
SHA1 hash:
aebc985c102432b0bf3ce20f6cd3a73d021d56b1
Detections:
win_pony_g0
win_pony_auto
SH256 hash:
86ffd39f8c53924a25935a4e1667487c2a63c7c8313e4d4f6bb13a9ac742db3b
MD5 hash:
021ec3cc05e073e136aa1d19e199b77c
SHA1 hash:
f386c2997fd05878ee3bb9638550deed6e2cf296
SH256 hash:
dcb0c2fab9bb65f7d2b8881f8c8f787152a4b6be70d85c12d3cacb5a2e1e2605
MD5 hash:
bff55cbdccb0359eb44587e63a9427c3
SHA1 hash:
65b18923e4e968389d0186bd5639bea5019dd04e
SH256 hash:
57933bc5c60de83fddbc7a2c6522e6481c9e684e342fed86a4c38bf08c4a6b0f
MD5 hash:
63533e07c471cf29ce6fc5887e933494
SHA1 hash:
01eea47a0f55b7df7d8275110fa159e5b82be64e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Fareit |
|---|---|
| Author: | kevoreilly |
| Description: | Fareit Payload |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many file transfer clients. Observed in information stealers |
| Rule name: | win_pony_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.pony. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.