MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaf1f655f2e2a22a288a74af7698bc09a5613745687b44e69bd98ed94631827a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eaf1f655f2e2a22a288a74af7698bc09a5613745687b44e69bd98ed94631827a
SHA3-384 hash: 892a04e667b4f8fd8d11ee2ac96fb42dbead26408e100367e851f1cd3a1a4461ce5f4ac66a752cefd2c4a0a3dd030fdd
SHA1 hash: 59b6ce673b5f1d7d1e254a1ddafb224f917488ce
MD5 hash: 0ad8cbab6fb7dcc7e35741b4ee122611
humanhash: cardinal-carpet-april-nevada
File name:Zayavka konec proshlogo mesyaca.001
Download: download sample
Signature Pony
Create hunting rule
File size:65'123 bytes
First seen:2020-07-31 11:26:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:pEKpN61DjgOFBmzJM+kL4mPbMLoXvUXDk6/oOTwTZ3O:jT61Ix61L3ICKkMoOSBO
TLSH BD5302695053D368EE25303954F7883B7C650ED1BD36DB022A5A37800A6BBF59EF7888
Reporter abuse_ch
Tags:001 geo Pony RUS


Avatar
abuse_ch
Malspam distributing Pony:

HELO: 1b.it-net.su
Sending IP: 176.107.248.116
From: Александра Зайцева <n.glazkova@1b.it-net.su>
Reply-To: Александра Зайцева <tarasovaek68@rambler.ru>
Subject: Возврат за этот месяц
Attachment: Zayavka konec proshlogo mesyaca.001 (contains "Zayavka konec proshlogo mesyaca.exe")

Pony C2:
http://45.61.138.109/p/z05857687.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
774
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eaf1f655f2e2a22a288a74af7698bc09a5613745687b44e69bd98ed94631827a/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 11:28:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ly7mvps4krcukekosxxngf4bgswcn2fnb5ujzu33ghnsrrrqj5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eaf1f655f2e2a22a288a74af7698bc09a5613745687b44e69bd98ed94631827a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar eaf1f655f2e2a22a288a74af7698bc09a5613745687b44e69bd98ed94631827a

(this sample)

Pony

Executable exe 97ba4ad5b02bc8812864b06941778432faf60a667c0279c0c7c092b76e91b9cc

  
Dropping
MD5 aa09b35809b0c229b78c7b0fd97ec85a
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97ba4ad5b02bc8812864b06941778432faf60a667c0279c0c7c092b76e91b9cc

Comments