MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9da2fc8e17dff51ad3de4ef9ff78d4196bd530a4aaa8e3c07e81e56df7a5c241. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 4
| SHA256 hash: | 9da2fc8e17dff51ad3de4ef9ff78d4196bd530a4aaa8e3c07e81e56df7a5c241 |
|---|---|
| SHA3-384 hash: | 6110a1d63a1f09b5f2a8336ae02d27f32306a86c7c9d82152056ac38fb242d16502b975ebeefa31aa88e1d88563cc96a |
| SHA1 hash: | 3c2247ddaeae69ea1c1f0014b5d598e48ad0bb81 |
| MD5 hash: | 6dbcd65ce9577036c49d104e313f8a2c |
| humanhash: | jig-virginia-asparagus-oranges |
| File name: | Spisok dok-ov za maj.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 177'216 bytes |
| First seen: | 2020-06-15 13:45:39 UTC |
| Last seen: | 2020-06-15 15:26:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6abe9c5e1ac1c31471d5a410ef357465 (1 x Pony) |
| ssdeep | 3072:XSL0pcWp0kkOznPVnWxRCrvzwbFI+tsqYah9ebnkDw:iwcekOzntnyMvzwxt0a4kc |
| Threatray | 144 similar samples on MalwareBazaar |
| TLSH | 0A04F3C079E7ED26DC615573A8A181A28622FC7DF6E0DEDB31C8792B29335D98413B13 |
| Reporter |  abuse_ch |
| Tags: | exe Pony |
abuse_ch
Malspam distributing Pony:HELO: mail.itch.ru
Sending IP: 77.240.144.162
From: Владислава Яковлева <garage@chuvashia.ru>
Reply-To: Владислава Яковлева <anastastbobrova48@rambler.ru>
Subject: Пакет документов 15е июня
Attachment: Spisok dok-ov za maj.001 (contains "Spisok dok-ov za maj.exe")
Pony C2:
http://137.74.157.159/p/z05857687.php
Intelligence
File Origin
# of uploads :
2
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2020-06-15 09:15:42 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
pony
Similar samples:
+ 134 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
spyware
Behaviour
Runs ping.exe
Script User-Agent
Suspicious use of WriteProcessMemory
Deletes itself
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.