MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68d21d20f6a9f46d9151aae1005b0e0335a8ec731aa9793d5d234307d4b7c0d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68d21d20f6a9f46d9151aae1005b0e0335a8ec731aa9793d5d234307d4b7c0d8
SHA3-384 hash: 58f38be86b3133cf87c32f4c1f9b9a035c1a5377f6bb92fbcd824acfd6636058d0c3e13da0e8d13e3b8c1f148e0040d0
SHA1 hash: 46bfbcd2fb9d4d708fee37df8d8844899b7141ac
MD5 hash: 67261168c98fe70bd7132a0bd67d0ccc
humanhash: failed-texas-william-failed
File name:Paket za proshlyj mesyac.001
Download: download sample
Signature Pony
Create hunting rule
File size:109'174 bytes
First seen:2020-08-31 13:45:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:TZ92GPn3mMk/5gov7zsY7VyOwhw+ZnwCkRNCCRIfLN0WYT:TJP275x7zsY7mhURN7IfLN0HT
TLSH 98B31218912F6C1EE5A7D179D001F3CF8606E6C5AF8D0EA0D3216DBDE99AC550E38A39
Reporter abuse_ch
Tags:001 Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: mail.tula.net
Sending IP: 212.12.0.5
From: Александра Архипова <vomol@volovo.tula.net>
Reply-To: Александра Архипова <tarasovaeka43@rambler.ru>
Subject: Пакет 31.08
Attachment: Paket za proshlyj mesyac.001 (contains "Paket za proshlyj mesyac.exe")

Pony C2:
http://142.93.0.206/p/z05857687.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
919
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68d21d20f6a9f46d9151aae1005b0e0335a8ec731aa9793d5d234307d4b7c0d8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-31 09:08:39 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndjb2ihwvh2g3ekrvlqqawyoam22r3dtdkuxspk5enbqpvfxydma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/68d21d20f6a9f46d9151aae1005b0e0335a8ec731aa9793d5d234307d4b7c0d8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar 68d21d20f6a9f46d9151aae1005b0e0335a8ec731aa9793d5d234307d4b7c0d8

(this sample)

Pony

Executable exe 785fb441663997067c0126c5574423d01242220e107db86c847ad8ea30752729

  
Dropping
MD5 03208be2340bbfea174cff970976b2c7
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 785fb441663997067c0126c5574423d01242220e107db86c847ad8ea30752729

Comments