MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pony

Vendor detections: 17

Intelligence 17 IOCs YARA 9 File information Comments

SHA256 hash:	6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da
SHA3-384 hash:	0916d4ebb6c78e8d7dc3cedc00cc98cfef5c73e0f10777d07e494042dece9966d2658ca4500d916a26a367054cd9a852
SHA1 hash:	5b1fbc4eb4430e320d56984a0d315dc2eadef5c2
MD5 hash:	f51d69c196b61f96b9c0b857b318d47d
humanhash:	oven-oven-seventeen-fifteen
File name:	F51D69C196B61F96B9C0B857B318D47D.exe
Download:	download sample
Signature	Pony Create hunting rule
File size:	107'008 bytes
First seen:	2024-03-04 14:35:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a6ad83a9deb34b860f8100383597fcc9 (1 x Pony)
ssdeep	1536:+m5I/q/5+CyqT3AD/DulW3LWBf+uUNjqaLeO1x9uRYuITv9gEFs7kzb5vRs/nt:DICB+C/lW3LWBfAeOB8XcgEvh6/nt
Threatray	199 similar samples on MalwareBazaar
TLSH	T122A30902F581F0F2C1A226727BC127B0E7FD9E6978768D0AFF5C5445BDB2697AB12102
TrID	55.5% (.EXE) Win32 Executable MS Visual C++ 4.x (134693/65) 12.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.9% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 5.4% (.SCR) Windows screen saver (13097/50/3) 4.3% (.EXE) Win64 Executable (generic) (10523/12/4)
Reporter	abuse_ch
Tags:	exe Pony

abuse_ch

Pony C2:
http://myetherwallet.kl.com.ua/1/web/gate.php

Intelligence

File Origin

# of uploads :

# of downloads :

377

Origin country :

Vendor Threat Intelligence

Malware family:

pony

ID:

File name:

6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da.exe

Verdict:

Malicious activity

Analysis date:

2024-03-04 15:19:58 UTC

Tags:

fareit pony trojan stealer raccoon

Link:

https://app.any.run/tasks/5d1d0894-b104-4aa6-883c-98eee0c53ecd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.Fareit-403

Win.Trojan.PonyStealer-9831667-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Reading critical registry keys

DNS request

Connection attempt

Sending an HTTP POST request

Sending an HTTP GET request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm crypto explorer fingerprint lolbin pony remote shell32 stealer

Link:

https://www.filescan.io/uploads/65e5dc5306b24253d236ca04/reports/85e40cf8-4fcb-48b7-8087-7e06ccb9c68c/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da

Malware family:

Pony

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3b03818c-d35a-4cea-8e25-bd430376c36a

Result

Threat name:

Fareit, Pony

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1402728

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Found C&C like URL pattern

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Fareit stealer

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da

Detection:

pony

Link:

https://mwdb.cert.pl/sample/6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2024-02-29 14:47:58 UTC

File Type:

PE (Exe)

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=njdisq3g3ssvbwpblfoyxb63iigyvfwhwvblguid7bctfcoujdna._file

Verdict:

malicious

Label(s):

pony

Pony

56bb12a6340433549f0b0ae8088579316758f696f9978659211c17119a061f5b

Pony

8ac1ca933b6fb64c3fc714d4a8ef7b7f0c7825ad8069d024cbc7d12679c6fdee

Pony

a142fcb452d74109fd945c8127ded8f6cf202ad73beff854ef44d5de2f06f18b

Pony

d7137a0b5b7839b715856b2d8608eda7136329624848a5cdc6d95dc05f7ad419

Pony

ef11640a48d75d3004ee987099adca738e43b7298a0b52913f4f9cc878422116

Pony

+ 189 additional samples on MalwareBazaar

Result

Malware family:

pony

Score:

10/10

Tags:

family:pony collection discovery persistence rat spyware stealer

Link:

https://tria.ge/reports/240304-ryjmasdf76/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

Enumerates physical storage devices

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Pony,Fareit

Malware Config

C2 Extraction:

http://myetherwallet.kl.com.ua/1/web/gate.php
http://myetherwallet.kl.com.ua/1/web/path/gate.php

Unpacked files

SH256 hash:

6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da

MD5 hash:

f51d69c196b61f96b9c0b857b318d47d

SHA1 hash:

5b1fbc4eb4430e320d56984a0d315dc2eadef5c2

Detections:

win_pony_auto

win_pony_g0

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

malware_windows_pony_stealer

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/a59cb2af-8abb-46eb-ac13-09725fe31bdc/

Malware family:

Pony

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6a46894366dc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Farheyt

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pony Create hunting rule
Author:	Brian Wallace @botnet_hunter
Description:	Identify Pony

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Windows_Trojan_Pony_d5516fe8 Create hunting rule
Author:	Elastic Security

Rule name:	win_pony_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
URL_MONIKERS_API	Can Download & Execute components	urlmon.dll::ObtainUserAgentString
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.DLL::OpenProcess KERNEL32.DLL::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA KERNEL32.DLL::GetSystemInfo
WIN_BASE_IO_API	Can Create Files	KERNEL32.DLL::CopyFileA KERNEL32.DLL::CreateDirectoryA KERNEL32.DLL::CreateFileA KERNEL32.DLL::CreateFileMappingA KERNEL32.DLL::DeleteFileA KERNEL32.DLL::GetWindowsDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::GetUserNameA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegCreateKeyA advapi32.dll::RegOpenCurrentUser advapi32.dll::RegOpenKeyExA advapi32.dll::RegOpenKeyA advapi32.dll::RegQueryValueExA advapi32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample