MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81e906112b133422acfdbef3eecb42cc856829f53a25941c794828c4ea28e120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	81e906112b133422acfdbef3eecb42cc856829f53a25941c794828c4ea28e120
SHA3-384 hash:	1f4ae865ef4c4403bee89502bc8e14873cc768d59e433c8a76f1afde8df0bda15e0f475a19286ee766c490fa27cb23da
SHA1 hash:	0cc57a2dda85a015ad98a873cb60df995c549350
MD5 hash:	049d64dcd9f9196616b3736432f93b72
humanhash:	fruit-quiet-oranges-thirteen
File name:	049d64dcd9f9196616b3736432f93b72.exe
Download:	download sample
Signature	Pony Alert Create hunting rule
File size:	31'744 bytes
First seen:	2023-07-14 17:10:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fd3adc5077b3a19a8142a087013e6a1b (7 x Pony)
ssdeep	768:T1k+0Fcs6EHJ/PesDsXGW7vYQdxB7/iX9KLqwYlqiUo3G/a:Z/m2ieGuvrN7/iGqwOT32/
TLSH	T196E202D377046ADBC4471BBF4B1736966422D8A04CFD4B80940C2B45B8AEB6DADE670B
TrID	34.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 34.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	abuse_ch
Tags:	exe Pony

abuse_ch

Pony C2:
http://escort.in.ua/axasxcdsvsdcpony/gate.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

313

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox Pony

Detection:

Pony

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/419648/

ClamAV Detected

Detection(s):

Win.Trojan.PonyStealer-9831667-0

Alert

Create hunting rule

Win.Trojan.Fareit-403

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Reading critical registry keys

DNS request

Sending an HTTP POST request

Stealing user critical data

Brute forcing passwords of local accounts

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm control explorer fareit greyware hacktool lolbin packed pony remote shell32 stealer

Link:

https://www.filescan.io/uploads/64b181a86da82c3a59cc4950/reports/bb1d9557-287e-4303-ba7c-4e700a79d82b/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/81e906112b133422acfdbef3eecb42cc856829f53a25941c794828c4ea28e120

Intezer Pony

Malware family:

Pony

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e47f430e-4b03-4be4-b9a5-06be13493961

Joe Sandbox Lokibot, Pony

Result

Threat name:

Lokibot, Pony

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1273338

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Detected Lokibot Info Stealer

Found C&C like URL pattern

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file registry)

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB pony

Detection:

pony

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/81e906112b133422acfdbef3eecb42cc856829f53a25941c794828c4ea28e120/

ReversingLabs TitaniumCloud Win32.Infostealer.Fareit

Threat name:

Win32.Infostealer.Fareit

Alert

Create hunting rule

Status:

Malicious

First seen:

2018-11-02 20:39:37 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

36 of 38 (94.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qhuqmejlcm2cflh5x3z65s2czscwqkpvhiszihdzjaumj2ri4eqa._file

Threatray malicious

Verdict:

malicious

Hatching Triage pony

Result

Malware family:

pony

Alert

Create hunting rule

Score:

  10/10

Tags:

family:pony collection discovery rat spyware stealer upx

Link:

https://tria.ge/reports/230714-vp9nxage2v/

Behaviour

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

UPX packed file

Pony,Fareit

Malware Config

C2 Extraction:

http://escort.in.ua/axasxcdsvsdcpony/gate.php

UnpacMe win_pony_auto win_pony_g0

Unpacked files

SH256 hash:

32ea3df132213560a19e8b50e6f49ec08cd744890792040ed1e973efd3108564

MD5 hash:

1d4f70e1102a5b7f58c9f933f0db3587

SHA1 hash:

4cf48c9da021fc469cb703ba1c8d5123dfd93449

Detections:

win_pony_auto

Alert

Create hunting rule

win_pony_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/fab98dfa-75bb-4e45-902b-ff2d8c1ccea2/

SH256 hash:

81e906112b133422acfdbef3eecb42cc856829f53a25941c794828c4ea28e120

MD5 hash:

049d64dcd9f9196616b3736432f93b72

SHA1 hash:

0cc57a2dda85a015ad98a873cb60df995c549350

Link:

https://www.unpac.me/results/fab98dfa-75bb-4e45-902b-ff2d8c1ccea2/

VMRay Pony

Malware family:

Pony

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/81e906112b13/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/419648/