MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f055effd1f500e383d3d28270462d1930f7234d893d447ad47eed90dfdccabc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f055effd1f500e383d3d28270462d1930f7234d893d447ad47eed90dfdccabc4
SHA3-384 hash: 8de31b9e3d872c70d9e77447c4dbbd00b11caa895382a9f2f7e3f256801dac3d6bd70bef73aa86f1dfcea3cad054c8b5
SHA1 hash: 6af0de2a18b9b7d5362e1bd50e826bb82cdf7cd1
MD5 hash: 303fdc6475f174faca90737556dcf946
humanhash: solar-comet-eighteen-cat
File name:a74dbc342d064a430478d31aacaaaced
Download: download sample
Signature Pony
Create hunting rule
File size:585'216 bytes
First seen:2020-11-17 15:49:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 11de4653e0d375638864e33af2182820 (2 x Pony, 2 x Loki)
ssdeep 12288:OZTm2Ds7yyGMLd4rgcGkDYfy/48eku2tfH7sgxVP808:q1AGyGMh4rgcGHy/Fek5nVP
Threatray 153 similar samples on MalwareBazaar
TLSH 48C49E2EB1A04C7BD2E32A79CC17C7A86831BD113D2B65457BF55D08BF39E91281A393
Reporter seifreed
Tags:Pony

Intelligence

File Origin
# of uploads :
1
# of downloads :
489
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Brute forcing passwords of local accounts
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f055effd1f500e383d3d28270462d1930f7234d893d447ad47eed90dfdccabc4/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:56:44 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bk677i7kahdqpj5fatqiywrsmhxengyspkeplkh53mq37omvpca._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
4d9ba9f2d2a2085cbdafebb0dc4b73058f45c4b86631d8fc11240e132a1e1d0d
Pony
4fb8dc37db10133ce52d868244771f6232f6ef9deb20fd4354af1ef3b36e2149
Pony
5592f091a845c7e32d8c66d5efa561fa9d0ce09c88a54927f8f43ca31373cf93
Pony
76f96173c9f07ead9a330ac935b73f5f695933f7b014bd4b51c13695119f3cec
Pony
859936cf64b25cbf05d8d910b98ff8ebbb721649c9c01652787c27a38c8000d7
Pony
9026e9b714998846a26087ed7f5a276b1399204a1e34d469571a7301ce720931
Pony
a8748c739e91e0be7301e29fdc33f6054a0db6f6b949dbedcc188b3dc97be92c
Pony
b01bb1b0f8138c7ce50860cd5218554d6b049d0862ec48a4e2076c6e6e309bed
Pony
cf857e8a28a380c5e001013c6fd13a67f02782a84829801b12079048e8d86cf0
Pony
e4b839be39665555c0637a45d7835cf5aed0633b9d3b3c72b0c3710555cf2eb0
Pony
+ 143 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-csmlzpx5p6/
Unpacked files
SH256 hash:
f055effd1f500e383d3d28270462d1930f7234d893d447ad47eed90dfdccabc4
MD5 hash:
303fdc6475f174faca90737556dcf946
SHA1 hash:
6af0de2a18b9b7d5362e1bd50e826bb82cdf7cd1
Link:
https://www.unpac.me/results/aa57880f-99dc-440d-a2de-3abb25152e1a/
SH256 hash:
eef383ab273ad64f3a9ac927b1ac01b9b204b1a8ac456a005b59af32e7502be4
MD5 hash:
384df8d5b987c5aa6c0a7f1aa0d415bf
SHA1 hash:
26ddcd77af862c054608bdadd1ac34808185680f
Detections:
win_pony_g0
Create hunting rule
win_pony_auto
Create hunting rule
Link:
https://www.unpac.me/results/aa57880f-99dc-440d-a2de-3abb25152e1a/
Parent samples :
4fb8dc37db10133ce52d868244771f6232f6ef9deb20fd4354af1ef3b36e2149
b01bb1b0f8138c7ce50860cd5218554d6b049d0862ec48a4e2076c6e6e309bed
cf857e8a28a380c5e001013c6fd13a67f02782a84829801b12079048e8d86cf0
76f96173c9f07ead9a330ac935b73f5f695933f7b014bd4b51c13695119f3cec
a8748c739e91e0be7301e29fdc33f6054a0db6f6b949dbedcc188b3dc97be92c
859936cf64b25cbf05d8d910b98ff8ebbb721649c9c01652787c27a38c8000d7
dfa87a6c76a74ba5bc6a291455a12ad1f7f70beeb3ae505dab167d7d6baef5b8
f055effd1f500e383d3d28270462d1930f7234d893d447ad47eed90dfdccabc4
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments