MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a00a6fe53b7e8d3f5ab9d8b8ab2119c9d3fcbe2b41a1fad6b29ed37e493a2ba0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 10
| SHA256 hash: | a00a6fe53b7e8d3f5ab9d8b8ab2119c9d3fcbe2b41a1fad6b29ed37e493a2ba0 |
|---|---|
| SHA3-384 hash: | 8860c6c1651829eba260049f68db1d84100b16daa80cf5e66a711e330343cf6c3c73f22b93f9519d0617a25940e745fd |
| SHA1 hash: | 01728691e041dfc0b2e757394b40438e561ba7b2 |
| MD5 hash: | 3ddac7136e99d1aa4c3cdf4869ea4656 |
| humanhash: | sweet-tango-lamp-lima |
| File name: | swift_7436623.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 417'280 bytes |
| First seen: | 2020-10-14 16:35:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:musyw0gTTPrv4XQDwQr6MgfuZvDDTDMl3X8K/ipUmY8tRAgwjxqDBhDGw:mDZvPmQ8c6pf+DHDcnoKmYyRijxGbD |
| Threatray | 115 similar samples on MalwareBazaar |
| TLSH | 9194E025338A9F21F57D97B320A0522013FAA2C59727EB5E7F8853C91963F40B752E1B |
| Reporter |  abuse_ch |
| Tags: | exe Pony |
abuse_ch
Malspam distributing Pony:HELO: changhong.com
Sending IP: 95.211.208.25
From: sales <li1.zheng@changhong.com>
Subject: RE: Payment contract invoice
Attachment: swift_7436623.iso (contains "swift_7436623.exe")
Loki C2:
http://tradesgroups.com/rex/panel/gate.php
Intelligence
File Origin
# of uploads :
1
# of downloads :
462
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Fareit
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Result
Threat name:
Lokibot Pony
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Detected Lokibot Info Stealer
Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Spyware.Stelega
Status:
Malicious
First seen:
2020-10-14 16:16:38 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
pony
Similar samples:
+ 105 additional samples on MalwareBazaar
Result
Malware family:
pony
Score:
10/10
Tags:
discovery rat spyware stealer family:pony evasion
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Maps connected drives based on registry
Checks BIOS information in registry
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Pony,Fareit
Unpacked files
SH256 hash:
a00a6fe53b7e8d3f5ab9d8b8ab2119c9d3fcbe2b41a1fad6b29ed37e493a2ba0
MD5 hash:
3ddac7136e99d1aa4c3cdf4869ea4656
SHA1 hash:
01728691e041dfc0b2e757394b40438e561ba7b2
SH256 hash:
97f0b7916d32e62e767a190e3ca1d51af9c1e7056511d4f184d76dce51f19e81
MD5 hash:
8fa175626e2f26fd307847581ade131f
SHA1 hash:
733161fde9d26028a0fc2363a09be56b045e8859
SH256 hash:
86307b6a995b2a72f4ca0eb6eb08e86ba8fc06553394eee1fc0984c0115fe95e
MD5 hash:
154d4840cc903d21c7742605d4a00355
SHA1 hash:
75ec6c7f9601707647b4d97cb8e74a19080474e7
Detections:
win_pony_g0
win_pony_auto
SH256 hash:
ece363cd81a4fefb1518bf0212a9315e1b16f9bd8b9a62297174fa460312e965
MD5 hash:
e75559ab27c527ae6cf6b1f4f05d698f
SHA1 hash:
d59c13022aacfed5ec822863ad8b424e1a634858
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.