MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eeef9fb66551b44e59276a611a008195094e3a2ab0904c031c2da59bcabaa563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eeef9fb66551b44e59276a611a008195094e3a2ab0904c031c2da59bcabaa563
SHA3-384 hash: 82ee9abbe63665b4cbbf9c0fede2f839b2b620905ec2651ac21460fe6b34987a752cef20dc8cf7efd7db1b1872c887c5
SHA1 hash: 4893367cec3767c3bb64f948bace31cf3e7a3196
MD5 hash: 627718a390bc04506a48fed68b5f871c
humanhash: undress-lithium-east-river
File name:Paket proverit.001
Download: download sample
Signature Pony
Create hunting rule
File size:87'107 bytes
First seen:2020-06-25 08:58:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:pSOfHN1saYdBOF93IwXlv5hgiD+4fWct4wwOfkIAWXVeEFXVfB+m48Y:htiaYdBgxIgRgw+4p1XVfBF48Y
TLSH 448302E8DF96DBC13FC063EC8D9F4122EB2662ACDE05B91725699044506AE87F0CDB5C
Reporter abuse_ch
Tags:001 geo Pony RUS


Avatar
abuse_ch
Malspam distributing Pony:

HELO: ir-tech.ru
Sending IP: 62.106.127.134
From: Евгения Копылова <deryabina@ir-tech.ru>
Reply-To: Евгения Копылова <tarasovaek51@rambler.ru>
Subject: Перечень проверить
Attachment: Paket proverit.001 (contains "Paket proverit'.exe")

Pony C2:
http://161.35.105.177/p/z05857687.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
750
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eeef9fb66551b44e59276a611a008195094e3a2ab0904c031c2da59bcabaa563/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=53xz7ntfkg2e4wjhnjqruaebsueu4orkwcieyay4fwszxsv2uvrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Pony

rar eeef9fb66551b44e59276a611a008195094e3a2ab0904c031c2da59bcabaa563

(this sample)

Pony

Executable exe 4bb2312117a9cca54bbb57f052f7a012d1971b1895fee03e35f6b657ac506bd1

  
Dropping
MD5 24cd884ff4ea1f5693373c67dde0a1cf
  
Dropping
Pony
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4bb2312117a9cca54bbb57f052f7a012d1971b1895fee03e35f6b657ac506bd1

Comments