🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 16


Intelligence 16 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6
SHA3-384 hash: 96ce783a5b734d511eb3c2aab5c1e25045b5ffe47caf11d3a9e3687913c90f1eaf2bb3eca4b40d2c24b70713b8410eba
SHA1 hash: 0bdccaf0647ecc27ad8aa2e30ca7e6e2bd7a79b5
MD5 hash: a5e61bb92aef8c949c788d64e53ff660
humanhash: kilo-xray-princess-mississippi
File name:DE3905C99B7D08B4B564DC1358EEA4F72FB034711F29D.exe
Download: download sample
Signature Pony
Create hunting rule
File size:76'468 bytes
First seen:2022-10-07 15:11:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 71da530f925f6036d48443d83ea89dc4 (1 x Pony)
ssdeep 1536:pwzqBAh7pIvi7TMgAasYn2nmho6fiqc3mKNc3VimHYU4cFgaLN:KRAagfeiqc2OclxHYUHFgaL
TLSH T1DC73AF4B7A409AE1F08784B04277956FEEE2C30187305AFBBF6C85127725782D9BC9D5
TrID 42.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
17.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4505/5/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Pony C2:
http://online-ca-drivers-ed.com/default.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://online-ca-drivers-ed.com/default.php https://threatfox.abuse.ch/ioc/872232/
http://smartysoftware.com/default.php https://threatfox.abuse.ch/ioc/872237/

Intelligence

File Origin
# of uploads :
1
# of downloads :
440
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Pony
Create hunting rule
Link:
https://www.capesandbox.com/analysis/317676/
Detection(s):
Win.Trojan.Agent-1138674
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Reading critical registry keys
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Brute forcing passwords of local accounts
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/41859/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cutwail fareit overlay packed shell32.dll zbot
Link:
https://www.filescan.io/uploads/63404188d089a0c15dd5bf33/reports/6e00093a-896f-4ec6-af9f-ec02405a982d/overview
Malware family:
Pony
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26020781-a1cb-4357-ab19-4c07ad079440
Result
Threat name:
Lokibot, Pony
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1085851
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected Lokibot Info Stealer
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Pony
Behaviour
Behavior Graph:
Download SVG
Detection:
pony
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2013-05-10 18:39:00 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3y4qlsm3pueljnle3qjvr3ve64x3andrd4u5pce6ldkt4hsbbh3a._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony collection discovery rat spyware stealer upx
Link:
https://tria.ge/reports/221007-sklp6scgc4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks installed software on the system
Checks computer location settings
Deletes itself
Reads data files stored by FTP clients
Reads user/profile data of web browsers
UPX packed file
Pony,Fareit
Malware Config
C2 Extraction:
http://smartysoftware.com/default.php?gLHGukLTpkxsXkC3aLbu7Ldz9OZNJB2q5
http://online-ca-drivers-ed.com/default.php?GcS17FrMfMXmzM1DzBznZFr463p
http://beacelebrityforonenight.com/default.php?6QHoGVxSeMJXfNyXCrmQy5Ii
http://earlytimeschapter.org/n.htm?RsEktUktHoRCd7VkulTlEV6XrOngroqCioks
http://earlytimeschapter.org/v.htm?KtA5oYuAPirxd5JXC1JMfdrrL45khyCLEJPv
http://earlytimeschapter.org/i.htm?m7e47RGVbBAgm9rbvBUkHQ4WaOK11NCVgBfT
http://madmillionaire.com/i.htm?4ui11eBjVjH5E6bxcriqsvAhdFLhOzsl4PNmxJA
http://madmillionaire.com/x.htm?i5onPfLHKDoDTbTCAEiIDxLXv7GJgxbBye7ut6V
http://madmillionaire.com/c.htm?cuDMZUPuGtTz9xFYzA1LaJDOlftyYeroXDhwvIY
http://danporterdev.com/v.htm?iRGoiXAFMNveN9SnEGhJPBiBSHq43jaq254wEM1QW
http://danporterdev.com/i.htm?t6i8LhEy3lxRRDO5Ag71QEHCrWSDZDjdulGOyqHRc
http://danporterdev.com/c.htm?R9QED3GydwHtFslTJzJiQ5HfgtY3O5N9cJPXdNeWE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4f78e414-f743-40ed-81b8-20e9525c22d1
Unpacked files
SH256 hash:
f04406a9707d213fe2a40a73b96540356c6edc73bc87e9a70e72b047806b9300
MD5 hash:
2f28d480acabdb4bde70df8852c2b81b
SHA1 hash:
22b38d09c61934e7cc5ea2e5fae55049588a4246
Detections:
win_pony_auto
Create hunting rule
win_pony_g0
Create hunting rule
Link:
https://www.unpac.me/results/cf5e62f2-b9f3-4c37-b3bb-66443f3b24cc/
SH256 hash:
de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6
MD5 hash:
a5e61bb92aef8c949c788d64e53ff660
SHA1 hash:
0bdccaf0647ecc27ad8aa2e30ca7e6e2bd7a79b5
Link:
https://www.unpac.me/results/cf5e62f2-b9f3-4c37-b3bb-66443f3b24cc/
Malware family:
Pony
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de3905c99b7d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/de3905c99b7d08b4b564dc1358eea4f72fb034711f29d7889e58d53e1e4109f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/317676/

Comments