MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64e1d47fdd9b9308f46a3c409761409f1ca6ae18c4f7180eef77434b4c46c323. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64e1d47fdd9b9308f46a3c409761409f1ca6ae18c4f7180eef77434b4c46c323
SHA3-384 hash: 53abed6a4983c11e5684c03aee5c0348629c2e7b1c7c40984c8367a4f7614302bcafd781edd7d85b9eefe444cdfac968
SHA1 hash: a301999c1c280f6b316a74f7e4cae233acfde014
MD5 hash: ae96ace0c903101346d076b961b026ca
humanhash: whiskey-snake-cold-lion
File name:REF-INV08022020.rar
Download: download sample
Signature Pony
Create hunting rule
File size:385'422 bytes
First seen:2020-08-04 06:10:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:EO+bCvvRGSPmAGUtMFPNkknc1Lp/tGpIFxOzxbvsZZnkmFJiglnSlq6Q95zN2isZ:bOORGSeA7Ikk69/teRKMglnflNtsJf
TLSH 2F84236F35345EE1651A92E8E7B27FDBDC340DB40C0E03E5FAC60B876A2416985A6F13
Reporter abuse_ch
Tags:Pony rar


Avatar
abuse_ch
Malspam distributing Pony:

HELO: gmail.com
Sending IP: 81.171.9.143
From: BBI <puneet.minocha@bbmiuae.com>
Reply-To: BBI <surnit9041@gmail.com>
Subject: INVOICE & DO
Attachment: REF-INV08022020.rar (contains "REF-INV08022020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
740
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64e1d47fdd9b9308f46a3c409761409f1ca6ae18c4f7180eef77434b4c46c323/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 06:12:07 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtq5i765tojqr5dkhrajoykat4oknlqyyt3rqdxpo5buwtcgymrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/64e1d47fdd9b9308f46a3c409761409f1ca6ae18c4f7180eef77434b4c46c323

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar 64e1d47fdd9b9308f46a3c409761409f1ca6ae18c4f7180eef77434b4c46c323

(this sample)

Pony

Executable exe 5e57e98ff9180e08404e1ddaf29e274ab4df1149b2cbfbdf3422ae460afbafac

  
Dropping
MD5 4615c67bf8ce7d58d4fb8493a33cb59b
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5e57e98ff9180e08404e1ddaf29e274ab4df1149b2cbfbdf3422ae460afbafac

Comments