MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 593b0f2f3ef3f79cd26f118b860f88b4743dbe5ce4f40e09a2858f08f2663697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 15
| SHA256 hash: | 593b0f2f3ef3f79cd26f118b860f88b4743dbe5ce4f40e09a2858f08f2663697 |
|---|---|
| SHA3-384 hash: | 4fd368fb9ea9906023fed8762c54eca3faeeadfefcf0ecb7fb0fcd4a5b502757790270c450924e6322c8f0a628319b8c |
| SHA1 hash: | 1456a056bbff99c5b94e4a6b458bd0e0f261788c |
| MD5 hash: | 67c5676dafcca0f53fbccba0d3999b17 |
| humanhash: | two-montana-romeo-muppet |
| File name: | 67c5676dafcca0f53fbccba0d3999b17.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 194'048 bytes |
| First seen: | 2023-04-08 13:40:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0ebb3c09b06b1666d307952e824c8697 (15 x RedLineStealer, 13 x LgoogLoader, 7 x NanoCore) |
| ssdeep | 3072:5nj9jtfU+INndIc0JJ5iiGfNgZsKmBz/q/hFA52eOMRkBYs+AeCq+0eANM8TClo8:5jbei3GfCPwmpFcrNkOsRq+dgM8TdcB |
| Threatray | 33 similar samples on MalwareBazaar |
| TLSH | T13014CF1357D9853BE0F523B089FD22A31379BCE42B78A3AF824945D95C312D1AA7835F |
| TrID | 82.1% (.EXE) Win32 MS Cabinet Self-Extractor (WExtract stub) (303567/2/11) 8.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 2.8% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.3% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | 848c5454baf47474 (2'466 x Adware.Neoreklami, 103 x RedLineStealer, 70 x N-able) |
| Reporter |  abuse_ch |
| Tags: | exe Pony |
Intelligence
File Origin
# of uploads :
1
# of downloads :
295
Origin country :
NLVendor Threat Intelligence
Malware family:
pony
ID:
1
File name:
67c5676dafcca0f53fbccba0d3999b17.exe
Verdict:
Malicious activity
Analysis date:
2023-04-08 13:41:14 UTC
Tags:
fareit pony trojan stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file
Enabling the 'hidden' option for recently created files
Enabling the 'hidden' option for files in the %temp% directory
Launching cmd.exe command interpreter
Creating a process with a hidden window
Reading critical registry keys
Launching a process
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Running batch commands
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Launching the process to interact with network services
Enabling autorun by creating a file
Brute forcing passwords of local accounts
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack.dll CAB installer packed rundll32.exe setupapi.dll shell32.dll upatre yakes
Verdict:
Malicious
Labled as:
Crifi.Generic
Malware family:
Pony
Verdict:
Malicious
Result
Threat name:
Lokibot, Pony
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to inject code into remote processes
Detected Lokibot Info Stealer
Disables security and backup related services
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Crifi
Status:
Malicious
First seen:
2015-10-14 12:56:00 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
22 of 37 (59.46%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 23 additional samples on MalwareBazaar
Result
Malware family:
pony
Score:
10/10
Tags:
family:pony collection discovery persistence rat spyware stealer upx
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
UPX packed file
Pony,Fareit
Malware Config
C2 Extraction:
http://dantewa.com.au/wp-includes/textq/exploitingsman/gate.php
Unpacked files
SH256 hash:
958d66e41287fdbce8ca1193c3ebc8c60ca68e26490f3e1829c3c08c374ea131
MD5 hash:
75cd1dd344e5bf3cad3a5e03b69d7ef2
SHA1 hash:
dae2e20ce6005bd6c0b519e0c660988fd06fa95e
SH256 hash:
b2640a7a8f4efaf5375d88550c59d95b90e92d474083eb4d3eba72069541e86c
MD5 hash:
8278028fed38b17233a6fa86b4cd7875
SHA1 hash:
b4c7f6d3d2741e8b1ebfaceb81e428e0045a100b
Detections:
win_pony_auto
win_pony_g0
SH256 hash:
5f30fc708573ac6380a1bf2d14283fa89cde0f23961205d94da11bd0563baa79
MD5 hash:
41f5140ffac8efcaf864c6923520c6fe
SHA1 hash:
92ffa0b4184540e5b92afdaf79369b630af5fcf0
Detections:
win_nitol_auto
SH256 hash:
4de87fa80484e78e2f09dc33348f281b58008b7d376ad9f1bd35d203aa956585
MD5 hash:
9b92fde14bd3f20930c11959f2d35c15
SHA1 hash:
0db86be28abaec420cc338ebe3343c252cb3ce72
SH256 hash:
593b0f2f3ef3f79cd26f118b860f88b4743dbe5ce4f40e09a2858f08f2663697
MD5 hash:
67c5676dafcca0f53fbccba0d3999b17
SHA1 hash:
1456a056bbff99c5b94e4a6b458bd0e0f261788c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.