MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0ee6b63b41a8bc598ee5a390b844c94cf7d9d7c152a4caf64fe7751f7a029ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0ee6b63b41a8bc598ee5a390b844c94cf7d9d7c152a4caf64fe7751f7a029ab
SHA3-384 hash: 7838b2b3283f226e62c5117db8f246be53dec5d0eb6567603169d618d69ab178e6aa82881175c88bd1703e13a907d3c4
SHA1 hash: 4274b6f51598c23e8e60f9c58d79eaf1755e7b89
MD5 hash: a6aa986aebc1e33d6a4d83ef0047277a
humanhash: oranges-fanta-mobile-jersey
File name:Spisok dok-ov za maj.001
Download: download sample
Signature Pony
Create hunting rule
File size:95'590 bytes
First seen:2020-06-15 13:45:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:sGd23p3PvWQFOfKQvXPI7hNqoF+XxgpvjLmdAGqtPWb/27Hm9MWWH+:sGd2Z3PVErPcNLIXxgNLjPWb/EWWH+
TLSH 9A93023B65022E04DA603721A3E3797AF3E29631B14726B568DDEBBCC7E507116279A0
Reporter abuse_ch
Tags:001 Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: mail.itch.ru
Sending IP: 77.240.144.162
From: Владислава Яковлева <garage@chuvashia.ru>
Reply-To: Владислава Яковлева <anastastbobrova48@rambler.ru>
Subject: Пакет документов 15е июня
Attachment: Spisok dok-ov za maj.001 (contains "Spisok dok-ov za maj.exe")

Pony C2:
http://137.74.157.159/p/z05857687.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
502
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:47:02 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=udxgwy5udkf4lgholi4qxbcmsthx3hl4cuvezl3e7z3vd55afgvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar a0ee6b63b41a8bc598ee5a390b844c94cf7d9d7c152a4caf64fe7751f7a029ab

(this sample)

Pony

Executable exe 9da2fc8e17dff51ad3de4ef9ff78d4196bd530a4aaa8e3c07e81e56df7a5c241

  
Dropping
MD5 6dbcd65ce9577036c49d104e313f8a2c
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9da2fc8e17dff51ad3de4ef9ff78d4196bd530a4aaa8e3c07e81e56df7a5c241

Comments