MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pony

Vendor detections: 17

Intelligence 17 IOCs YARA 8 File information Comments

SHA256 hash:	71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33
SHA3-384 hash:	7930084a9a971383cb24188f24d7898568dfc57faf01dc394dddd79242f71d6a8e56a54991784c757cb91de572b27dbc
SHA1 hash:	b768286921741aa0ce47c6485a922dc76f4d732f
MD5 hash:	c1090629855ae54545498aaa7738e352
humanhash:	carpet-west-indigo-spring
File name:	c1090629855ae54545498aaa7738e352.exe
Download:	download sample
Signature	Pony Create hunting rule
File size:	719'258 bytes
First seen:	2023-05-31 23:15:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep	12288:RquErHF6xC9D6DmR1J98w4oknqOKw59XxYRcjnn+ClOq60XDv8OOTHiBHl:Url6kD68JmloO5TYI1lOq6sb8hTHAl
Threatray	91 similar samples on MalwareBazaar
TLSH	T178E4DF963697AC09FCACBA310DA69560C860ED717864CDBA61B4FB3E59332049F3171F
File icon (PE):
dhash icon	f9f1c0c8f123e6e6 (9 x Pony)
Reporter	abuse_ch
Tags:	exe Pony

abuse_ch

Pony C2:
http://185.79.156.18/bit/03/gate.php

Intelligence

File Origin

# of uploads :

# of downloads :

367

Origin country :

Vendor Threat Intelligence

Malware family:

pony

ID:

File name:

c1090629855ae54545498aaa7738e352.exe

Verdict:

Malicious activity

Analysis date:

2023-05-31 23:17:41 UTC

Tags:

fareit pony trojan stealer

Link:

https://app.any.run/tasks/4b1d4b8d-799f-496c-8c54-deff3b8f9e56

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Fareit

Link:

https://www.capesandbox.com/analysis/394223/

Detection(s):

Win.Trojan.Autoit-9946827-0

Win.Malware.Azorult-6971822-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Launching a process

Сreating synchronization primitives

Reading critical registry keys

Running batch commands

Creating a process with a hidden window

Sending a custom TCP request

Creating a file in the %temp% directory

Stealing user critical data

Enabling autorun

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Brute forcing passwords of local accounts

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/88854/overview

Behaviour

MalwareBazaar

MeasuringTime

CheckNumberOfProcessor

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autoit lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6477d532c7f28a347f89dac4/reports/ed83d7b3-a9b4-4320-b1ea-86944d91967d/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c2e09127-4065-4ba1-bf89-92e8adb3a66d

Result

Threat name:

Pony

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1246449

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2023-05-28 07:17:42 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 37 (83.78%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ohuvpeo36ihfwq53owy5idpj72gmk3nvychysm7yxrydg5s3zmzq._file

Verdict:

malicious

Label(s):

pony

Pony

4b47e10740c284c9a1617a0f25548c1e25f2fd25aebac939339b2dfb0c882502

Pony

5dfc270f4ab0582f5718784c455623755d8fb7a22a2e8db4d98be5ecb913352c

Pony

5f01277eb7aa0580f6c084ed456dc42c06a2d0a1be268fb2ec650c82c752afde

Pony

9ecb3553a9b19155cb2022f5620153581a2b370655f66a53caf44cd920330471

Pony

c97adcbfb32cd9719b5067c875527e7434409e0bcddeb6b50fc51b255a94c52f

Pony

f9c90c61043fcb8fb22679e39061bf84bf44ab4833e02ef0d93305ca1aa4e81e

Pony

fe3592daf199ad2b458ecd1493e597cd5602f34b4cdd54c32aa942bf3cce07f9

Pony

+ 81 additional samples on MalwareBazaar

Result

Malware family:

pony

Score:

10/10

Tags:

family:pony collection discovery rat spyware stealer upx

Link:

https://tria.ge/reports/230531-284qbsbh8w/

Behaviour

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_win_path

Enumerates physical storage devices

AutoIT Executable

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

UPX packed file

Pony,Fareit

Malware Config

C2 Extraction:

http://185.79.156.18/bit/03/gate.php

Unpacked files

SH256 hash:

1a3e037affe1ad6c887bb5aa7806269aa1d4d2fe0754bf6c89d04354e3cb2e65

MD5 hash:

6c0c3b11cdd1bc1c23e75cb684d8baba

SHA1 hash:

27e838d1431bc06a8185b461fc6d4e838a6d1567

Detections:

win_pony_auto

win_pony_g0

Link:

https://www.unpac.me/results/6005d3a9-162f-444b-b8af-5bf1af6dc84f/

Parent samples :

e80b1723280023b1125b739fcbc94b46da10a4c702c39ca419189d052700d132
7c4e0b95c73cc6c75ad1c74bc4bb7ea27444015c9934a000cf183eb5d4948a3b
71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33
359085ce4ec341aac7c0d129418e257a0e570f058855a0ddf81a3bbc70bdbe0d
399ff9fc9b00cd465bf4ebe51c05b2252efd5631afa01d90543aa3ee68e48832
c82b062d79bbce1df07ed3dfe3d72faf33edd98a883f36344cc8cd4da9ffa36b
d53dd7d82baec5078999c4aa1d81e2cdb0f137f6950030070a99736ff757a7c0
395c6151624f73b39fdfd282534279878b433efb964bcc15cad2e4f818d89eb8
b5d4330129d989156cb6df8fc9a95e1a45c4d57b8852cf5f720c80a0a6a4935f

SH256 hash:

862528e7c937ebc73eff0fa69a5e0b759c7aa93859bfea23c40ed7ba72a85f8f

MD5 hash:

d17a087af02b189f175c724d3bf52194

SHA1 hash:

3446964105e021eed1fd880a47f613d6ae787645

Link:

https://www.unpac.me/results/6005d3a9-162f-444b-b8af-5bf1af6dc84f/

SH256 hash:

71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33

MD5 hash:

c1090629855ae54545498aaa7738e352

SHA1 hash:

b768286921741aa0ce47c6485a922dc76f4d732f

Link:

https://www.unpac.me/results/6005d3a9-162f-444b-b8af-5bf1af6dc84f/

Malware family:

Pony

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/71e95791dbf2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/71e95791dbf20e5b43bb75b1d40de9fe8cc56db5c08f8933f8bc7033765bcb33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	Fareit Create hunting rule
Author:	kevoreilly
Description:	Fareit Payload

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	pony Create hunting rule
Author:	Brian Wallace @botnet_hunter
Description:	Identify Pony

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	Windows_Trojan_Pony_d5516fe8 Create hunting rule
Author:	Elastic Security

Rule name:	win_pony_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/394223/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample