MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pony

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 9 File information Comments

SHA256 hash:	e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637
SHA3-384 hash:	0fc610b2ffc3d9ce614d01ebef367f52e4d88076fc6171038a988b7b9e0ea24b3cd277078ef1ca5639a09cd491a461bf
SHA1 hash:	9efdd367643baa158e5d51ca26553313bc6dcd27
MD5 hash:	9634a80228a6d385b70c74db6f22118e
humanhash:	april-nineteen-montana-maine
File name:	9634A80228A6D385B70C74DB6F22118E.exe
Download:	download sample
Signature	Pony Create hunting rule
File size:	314'880 bytes
First seen:	2021-06-16 22:36:28 UTC
Last seen:	2021-06-16 23:43:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:HuNt3ej7WrLJ0z3j5KnUxtVYg9Gl6EYKjL8DPP:Hu3evWLJ6jYnM9GE9KjL8DP
Threatray	245 similar samples on MalwareBazaar
TLSH	D2649C5331468AB7E2131CBA4C1EC2B215D7AE24142AB51D75AA331F19F232613EFB5F
Reporter	abuse_ch
Tags:	exe Pony

abuse_ch

Pony C2:
http://212.192.241.203/sor/gate.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://212.192.241.203/sor/gate.php	https://threatfox.abuse.ch/ioc/131156/

Intelligence

File Origin

# of uploads :

# of downloads :

543

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9634A80228A6D385B70C74DB6F22118E.exe

Verdict:

No threats detected

Analysis date:

2021-06-16 22:40:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f4bd5a14-af91-4b73-b599-6c6f1cc11b60

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46485541.7134.12752.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Pony

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1d6d6899-e13c-438d-8bc8-329987aa0769

Result

Threat name:

Lokibot Pony

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/803397

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected Lokibot Info Stealer

Drops / launches Pony Loader self-deletion script - malware possibly based on Pony Loader leaked source code

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Pony

Behaviour

Behavior Graph:

Download SVG

Detection:

pony

Link:

https://mwdb.cert.pl/sample/e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-06-14 07:52:42 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5cnmoeumorqdrbkq7akfsxqjvnmw3mhw63afrdvw57nmbyzqey3q._file

Result

Malware family:

pony

Score:

10/10

Tags:

family:pony discovery rat spyware stealer

Link:

https://tria.ge/reports/210616-8mrht3z7mj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks installed software on the system

Deletes itself

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Pony,Fareit

Malware Config

C2 Extraction:

http://212.192.241.203/sor/gate.php

Unpacked files

SH256 hash:

47660b3f0c87af54234903093413940935e3458075c1cc1f035640c19f21dbb2

MD5 hash:

27c98c40a0de3a89e2bccb29976fa637

SHA1 hash:

f56be547ddf1aa625dc40d480ecd0c9875b017dc

Link:

https://www.unpac.me/results/acfc9709-bccf-40d2-b3d9-e0fdc49cf16a/

SH256 hash:

0b769e80a51be816533c2bed0790f5a5549086c96cd5f035e11d129078fa7bb0

MD5 hash:

31f6a6c2e581f248b3483a25ef92c8d9

SHA1 hash:

e00dd787d01aff7a1b5082698386ff0f16f5b6b9

Detections:

win_pony_g0

win_pony_auto

Link:

https://www.unpac.me/results/acfc9709-bccf-40d2-b3d9-e0fdc49cf16a/

SH256 hash:

ced7b6fc6120cd27d1cab233d415626661f300bbb0ed06f79c8710f13a7423e5

MD5 hash:

d297eec9c46c48d43ac5dbe4d97fe8d4

SHA1 hash:

535bd8b168c22032d18b8003906e05fac96c2a51

Link:

https://www.unpac.me/results/acfc9709-bccf-40d2-b3d9-e0fdc49cf16a/

SH256 hash:

e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637

MD5 hash:

9634a80228a6d385b70c74db6f22118e

SHA1 hash:

9efdd367643baa158e5d51ca26553313bc6dcd27

Link:

https://www.unpac.me/results/acfc9709-bccf-40d2-b3d9-e0fdc49cf16a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	Fareit Create hunting rule
Author:	kevoreilly
Description:	Fareit Payload

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	pe_imphash Create hunting rule

Rule name:	pony Create hunting rule
Author:	Brian Wallace @botnet_hunter
Description:	Identify Pony

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	win_pony_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample