MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pony

Vendor detections: 19

Intelligence 19 IOCs 1 YARA 9 File information Comments

SHA256 hash:	b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7
SHA3-384 hash:	36b4b86a99f7fb9fcdae17dc7755efa37b3505643c94fe1ad7b61364f799bbada24f3a44892df21d4c7c6470153ac010
SHA1 hash:	827204202faf7a69fd796f7904666e55b004969e
MD5 hash:	d81d50327fd3ccb4bdebc70c29f9bedb
humanhash:	mountain-tennessee-carolina-three
File name:	key.exe
Download:	download sample
Signature	Pony Create hunting rule
File size:	105'984 bytes
First seen:	2024-08-26 17:35:51 UTC
Last seen:	2024-09-02 15:29:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	085f942c74d09a78dcd2b95a4c1c7441 (14 x Pony)
ssdeep	1536:vt8UEN3YqiqTLEcW+L9gs2rS+TTYz52kqnjQXyAOrc6neTvUkzbklql/2fqh:Ch1H1W9+eNkdOrDn+0ql/2fqh
Threatray	287 similar samples on MalwareBazaar
TLSH	T185A30903F881E0F1C1A2177237C16771E3FD9D79BC768D4AEF8D6845A9B2687AB12402
TrID	70.0% (.EXE) Win32 Executable MS Visual C++ 4.x (134693/65) 16.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 3.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 2.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 2.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	18d8f809b8d86e84 (6 x Pony)
Reporter	aachum
Tags:	exe KeygenGuru Pony

iamaachum

Pony C2: http://top.enkey.click/bussin/gate.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://top.enkey.click/bussin/gate.php	https://threatfox.abuse.ch/ioc/1316501/

Intelligence

File Origin

# of uploads :

# of downloads :

409

Origin country :

Vendor Threat Intelligence

Malware family:

pony

ID:

File name:

key.exe

Verdict:

Malicious activity

Analysis date:

2024-08-26 17:37:36 UTC

Tags:

fareit pony stealer trojan

Link:

https://app.any.run/tasks/ecffaae4-17ca-40a2-a183-9e62d66a4e15

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.PonyStealer-9831667-0

Win.Trojan.Fareit-403

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ccbd05e7ff3f5a063c055f

Tags:

Execution Infostealer Network Stealth Kryptik

Result

Verdict:

Malware

Maliciousness:

Behaviour

Reading critical registry keys

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %temp% directory

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Stealing user critical data

Brute forcing passwords of local accounts

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm crypto explorer fingerprint lolbin pony remote shell32 stealer

Link:

https://www.filescan.io/uploads/66ccbd04b854095a010a9cd0/reports/9dd01865-21d7-4d8b-afa8-1f0f108e0a64/overview

Verdict:

Malicious

Labled as:

Trojan.PWS.Tepfer

Link:

https://www.hybrid-analysis.com/sample/b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

Malware family:

Pony

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/58c40dfd-7827-4fa7-83c7-212a94fcd20e

Result

Threat name:

Fareit, Pony

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1499247

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Pony trojan / infostealer detected

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Fareit stealer

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

Detection:

pony

Link:

https://mwdb.cert.pl/sample/b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7/

Threat name:

Win32.Infostealer.Pony

Status:

Malicious

First seen:

2024-08-26 17:36:12 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wcfewlubrqwovea36qo2ufrhelpnriytni4meb2trlerh24hm7lq._file

Verdict:

malicious

Label(s):

pony

Pony

6f7f549cc129824283a402180c348073daee1eecfb00805156e3013f78390523

Pony

8ec2c238e503fa897571575191abe23b5ba2d80f523473e710c390c51063d9d6

Pony

b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

Pony

b95cc7fcff0db3482364284d26cfe8e1f9d9ca49116973fc864e44cf847ea8cf

Pony

d28d9df11b70bc1ebc1a52688d78818abb4a5f4b0af1292d0b1b1457984fca24

Pony

+ 277 additional samples on MalwareBazaar

Result

Malware family:

pony

Score:

10/10

Tags:

family:pony collection credential_access discovery rat spyware stealer

Link:

https://tria.ge/reports/240826-v6j5ksxgjr/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Credentials from Password Stores: Credentials from Web Browsers

Pony,Fareit

Malware Config

C2 Extraction:

http://top.enkey.click/bussin/gate.php

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1a4f7c92-80c6-4c53-b6fc-bd5d880cea2a

Unpacked files

SH256 hash:

b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

MD5 hash:

d81d50327fd3ccb4bdebc70c29f9bedb

SHA1 hash:

827204202faf7a69fd796f7904666e55b004969e

Detections:

win_pony_auto

win_pony_g0

malware_windows_pony_stealer

Link:

https://www.unpac.me/results/5c512afc-8ce6-4d48-8394-3b66ec40d6d5/

Malware family:

Pony

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b08a4b2e818c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Farheyt

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Fareit Create hunting rule
Author:	kevoreilly
Description:	Fareit Payload

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pony Create hunting rule
Author:	Brian Wallace @botnet_hunter
Description:	Identify Pony

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Windows_Trojan_Pony_d5516fe8 Create hunting rule
Author:	Elastic Security

Rule name:	win_pony_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe edbe03f74167f65d2c416d8dd7dd809ecbcc39b1dcdbd9fb8a7797503170e5db

Pony

exe b08a4b2e818c2cea901bf41daa162722ded8a3136a38c207538ac913eb8767d7

(this sample)

Link

https://tria.ge/240826-v2sk6axenr

Delivery method

Other

Dropped by

SHA256 edbe03f74167f65d2c416d8dd7dd809ecbcc39b1dcdbd9fb8a7797503170e5db

Dropped by

MD5 9f52f0ddebef7dae9a591cebf727d9ef

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
URL_MONIKERS_API	Can Download & Execute components	urlmon.dll::ObtainUserAgentString
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::OpenProcess kernel32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::CreateFileMappingA kernel32.dll::DeleteFileA kernel32.dll::GetWindowsDirectoryA kernel32.dll::GetFileAttributesA
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::GetUserNameA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegCreateKeyA advapi32.dll::RegOpenCurrentUser advapi32.dll::RegOpenKeyExA advapi32.dll::RegOpenKeyA advapi32.dll::RegQueryValueExA advapi32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample