MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 63663eec6cbc4ced91ac730c6b4789ff67241d1fbb4d522e84c0ad0e7828261e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 15
| SHA256 hash: | 63663eec6cbc4ced91ac730c6b4789ff67241d1fbb4d522e84c0ad0e7828261e |
|---|---|
| SHA3-384 hash: | feeafe06e753c195e4a0b0b888eabe01965654ae9611d4e14800914ed61b64fce32c13ca4abc6562b89e796841e0c132 |
| SHA1 hash: | 0ab922c068513cfa2401a9b2e55d879eb4830382 |
| MD5 hash: | dfc05a4e8e29a348af7039a78ff59270 |
| humanhash: | oranges-blue-snake-mobile |
| File name: | dfc05a4e8e29a348af7039a78ff59270.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 201'376 bytes |
| First seen: | 2024-09-15 21:40:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4ba127fe6eacb6b5853313f4b9c03263 (4 x Pony) |
| ssdeep | 1536:QN8X9ie1AtM1icxMYxPHS+5IQbgSl1BP8hM44V+aYSwlikUEu+EQUQXjFm9G0Ky:vX9i+p1iuHS++v07101likUEu2zL0Ky |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | T12114E03175419C6FD9A168B8A629C514E03098350FE0947FBEDF411ECE6E2AD20EF9AD |
| TrID | 83.6% (.EXE) Win32 Executable MS Visual C++ 4.x (134693/65) 4.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 2.7% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | exe Pony signed |
Code Signing Certificate
| Organisation: | 797871756289634253896562428764717967153361673529868625515891451715252584769788918372438574322411216259565529928552691682658776517582536117728595793761 |
|---|---|
| Issuer: | 797871756289634253896562428764717967153361673529868625515891451715252584769788918372438574322411216259565529928552691682658776517582536117728595793761 |
| Algorithm: | sha1WithRSA |
| Valid from: | 2012-07-17T06:12:45Z |
| Valid to: | 2039-12-31T23:59:59Z |
| Serial number: | -69d0c8ba19313f73bb36a5a873acd009 |
| Intelligence: | 2 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | c65e341d9daf4790728ba0160249f5eb9516e40fc3f41ff79127375befc9ea8b |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://74.91.112.151/pony/gate.php | https://threatfox.abuse.ch/ioc/1325222/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
455
Origin country :
NLVendor Threat Intelligence
Malware family:
pony
ID:
1
File name:
63663eec6cbc4ced91ac730c6b4789ff67241d1fbb4d522e84c0ad0e7828261e.zip
Verdict:
Malicious activity
Analysis date:
2024-09-16 14:34:16 UTC
Tags:
stealer trojan pony fareit
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Verdict:
Malicious
Score:
99.1%
Tags:
Encryption Static Zbot
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
overlay packed xpack zbot
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Malware family:
Pony
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Infostealer.Zeus
Status:
Malicious
First seen:
2013-03-09 21:02:00 UTC
File Type:
PE (Exe)
AV detection:
37 of 38 (97.37%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
pony
Score:
10/10
Tags:
family:pony collection credential_access discovery rat spyware stealer
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
outlook_win_path
Program crash
System Location Discovery: System Language Discovery
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks installed software on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Credentials from Password Stores: Credentials from Web Browsers
Pony,Fareit
Malware Config
C2 Extraction:
http://etsiunjour.fr:81/pony/gate.php
http://74.91.112.151/pony/gate.php
http://74.91.112.151/pony/gate.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
63663eec6cbc4ced91ac730c6b4789ff67241d1fbb4d522e84c0ad0e7828261e
MD5 hash:
dfc05a4e8e29a348af7039a78ff59270
SHA1 hash:
0ab922c068513cfa2401a9b2e55d879eb4830382
Malware family:
Pony
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::VirtualAllocEx |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegOpenKeyW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.