MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c83d6e6989b8e850ca5f411c67bcbfff8dff55d6d1348dc8961227a5eac92c8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Pony
Vendor detections: 4
| SHA256 hash: | c83d6e6989b8e850ca5f411c67bcbfff8dff55d6d1348dc8961227a5eac92c8a |
|---|---|
| SHA3-384 hash: | b70ec07d5ccbc381e0b12be179ba77ee4966da8aeeff1a0bfb33e2cf3bb3ab40831ab08399975e23fd9775cfbb531b39 |
| SHA1 hash: | b52bf1752643aa313d587ba0e32f2f0dee71f863 |
| MD5 hash: | 6cc22d85ea40ef7ca2c68f7d0b136e2d |
| humanhash: | lithium-georgia-fruit-march |
| File name: | effa8581cc6327a67f106d077ea9efff.exe |
| Download: | download sample |
| Signature | Pony |
| File size: | 91'648 bytes |
| First seen: | 2020-03-30 21:56:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fbab3e022f0aa68f4af07dff0d4cfb9f (8 x Pony) |
| ssdeep | 1536:RcEY/ws9qTT72dtvsS9siS4AIkESMNQ+C3mDXx5mO4SpytMTvHEKokzmY:aEzKtpAIZNQbOUQEKUY |
| Threatray | 126 similar samples on MalwareBazaar |
| TLSH | BD930903F480E0F1C0A12BB277C15760E7F9AE697C3A8D5EEF5C49856DB26877B16042 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader Pony |
abuse_ch
Payload dropped by GuLoader from the following URL:https://drive.google.com/uc?export=download&id=1ycKFbZb240iPYpjZWgSaHFYrS1yqGr4g
Intelligence
File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-03-30 22:35:30 UTC
File Type:
PE (Exe)
AV detection:
31 of 31 (100.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
pony
Similar samples:
+ 116 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
36a65f7f9930cab282ec0b4ecd24622e7aaaa433a750a4f243b3205b6ba3231d
Dropped by
MD5 effa8581cc6327a67f106d077ea9efff
Dropped by
MD5 dd36d59544af4b11e850fd483d135b04
Dropped by
GuLoader
Dropped by
SHA256 36a65f7f9930cab282ec0b4ecd24622e7aaaa433a750a4f243b3205b6ba3231d
Dropped by
SHA256 a56fd63fc05c5835b50ae95264933fa24039555969ee0d3771c86a5b8fc481ed
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal |
| WIN32_PROCESS_API | Can Create Process and Threads | kernel32.dll::OpenProcess kernel32.dll::CloseHandle |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo |
| WIN_BASE_IO_API | Can Create Files | kernel32.dll::CreateDirectoryA kernel32.dll::CreateFileA kernel32.dll::CreateFileMappingA kernel32.dll::DeleteFileA kernel32.dll::GetWindowsDirectoryA kernel32.dll::GetFileAttributesA |
| WIN_BASE_USER_API | Retrieves Account Information | advapi32.dll::GetUserNameA |
| WIN_REG_API | Can Manipulate Windows Registry | advapi32.dll::RegCreateKeyA advapi32.dll::RegOpenCurrentUser advapi32.dll::RegOpenKeyExA advapi32.dll::RegOpenKeyA advapi32.dll::RegQueryValueExA advapi32.dll::RegSetValueExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.