MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfc8bea365ff5d81ebdd46e4e453951b21f690c635f5040f8163568515694d2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfc8bea365ff5d81ebdd46e4e453951b21f690c635f5040f8163568515694d2d
SHA3-384 hash: 583543fe463b97938a0ed4fc2fd3660eea0c51e22ac182c88d7de7d77bccb5999496881aa172b2942c94e20e871e1441
SHA1 hash: 0f57dd8ef1ff6d84106fa4067bf29eff776ea557
MD5 hash: 55393db0540b0362f77a8d0e98b86f1a
humanhash: four-pasta-florida-crazy
File name:swift_7436623.iso
Download: download sample
Signature Pony
Create hunting rule
File size:479'232 bytes
First seen:2020-10-14 16:35:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:Dusyw0gTTPrv4XQDwQr6MgfuZvDDTDMl3X8K/ipUmY8tRAgwjxqDBhDGw:DDZvPmQ8c6pf+DHDcnoKmYyRijxGbD
TLSH A4A4E025338A9F21F57C97B320A0512013FAA2C59677EB5A7F8C53891B63F40B652F1B
Reporter abuse_ch
Tags:iso Pony


Avatar
abuse_ch
Malspam distributing Pony:

HELO: changhong.com
Sending IP: 95.211.208.25
From: sales <li1.zheng@changhong.com>
Subject: RE: Payment contract invoice
Attachment: swift_7436623.iso (contains "swift_7436623.exe")

Loki C2:
http://tradesgroups.com/rex/panel/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
775
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3334.7830.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfc8bea365ff5d81ebdd46e4e453951b21f690c635f5040f8163568515694d2d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 16:14:57 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=37el5i3f75oyd265i3soiu4vdmq7negggx2qid4bmnlikfljjuwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dfc8bea365ff5d81ebdd46e4e453951b21f690c635f5040f8163568515694d2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

iso dfc8bea365ff5d81ebdd46e4e453951b21f690c635f5040f8163568515694d2d

(this sample)

Pony

Executable exe a00a6fe53b7e8d3f5ab9d8b8ab2119c9d3fcbe2b41a1fad6b29ed37e493a2ba0

  
Dropping
MD5 3ddac7136e99d1aa4c3cdf4869ea4656
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a00a6fe53b7e8d3f5ab9d8b8ab2119c9d3fcbe2b41a1fad6b29ed37e493a2ba0

Comments