MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PondRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528
SHA3-384 hash: d9974739c2dd2c8213d1ffe3ca98a38e4b2138da768ab1b0b76308ccb1d9bf57e6292ac610b6f4b01b0958bf6dd63d0a
SHA1 hash: 09d1f80ff949f95ff4e19f215b2a80ab17f1192d
MD5 hash: 162a59ed734060237de64913897583c9
humanhash: leopard-ink-cat-glucose
File name:f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528_macos_pondrat.bin
Download: download sample
Signature PondRAT
Create hunting rule
File size:173'792 bytes
First seen:2025-09-15 14:03:09 UTC
Last seen:Never
File type:php macho
MIME type:application/x-mach-binary
ssdeep 768:yK8aqXC717D867GIX8iTt4S66+6aOxJTlOoTbcAnZBksh4M1Q:AHw8dI46aOxukbH8U4
TLSH T140043A42FF481807C8C5803D5AB947424163F2567AA6D3BF2B58A71CAFAD3D5731AA0B
TrID 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika macho
Reporter SRT
Tags:Lazarus machO PondRAT RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
ditekSHen.MALWARE.Osx.Trojan.PondRAT.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c81cc1d49ea3f1e4b60176
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 masquerade
Link:
https://www.filescan.io/uploads/68c81cbc73287948292a8739/reports/9eadeb10-ebb3-48cb-8fa3-80f18d2e23ce/overview
Verdict:
Malicious
Labled as:
Trojan.MAC.Lazarus.7;Gen:Trojan.MAC.Lazarus.Generic
Link:
https://www.hybrid-analysis.com/sample/f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528
Verdict:
Malicious
File Type:
macho fat
First seen:
2025-09-12T10:20:00Z UTC
Last seen:
2025-09-12T10:20:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
Mach-O universal binary
Link:
https://malprob.io/report/f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528/
Threat name:
MacOS.Trojan.NukeSpeed
Create hunting rule
Status:
Malicious
First seen:
2025-09-12 15:53:34 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6azbze6jh6qwfbk7r2sdkzri5337kkcesicpil57uabjkwqluuua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Multi_PondRAT
Create hunting rule
Author:ditekshen
Description:Detects PondRAT
Rule name:SimpleTea
Create hunting rule
Author:Still
Description:attempts to match strings/instructions found in SimpleTea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/

Comments