MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pony


Vendor detections: 13


Intelligence 13 IOCs 2 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874
SHA3-384 hash: e3739d5b3ac1056b42cc5b6d939af76c3f2f8286d82650cac677b33333e6e5037ffdedf2d272a6e15d40fa880339a8c7
SHA1 hash: 60f058765cde196581d5d20ec47fbb045a51cdbb
MD5 hash: 30a1f73357e2088bdda8c95c2dda0eac
humanhash: eight-pluto-table-hot
File name:F2945753C6CEDF8E7B8E8F4E04859591C3EDF18C7652A.exe
Download: download sample
Signature Pony
Create hunting rule
File size:91'648 bytes
First seen:2021-08-16 07:50:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d777357137fc148884e24f774b09e366 (7 x Pony)
ssdeep 1536:JaeFDUyOAqTr2iz4U7XliQZS4hQz9518q7UdOkdATvVEwTkzmX:DR4sU7ViQZS1zgOkdUEwLX
Threatray 312 similar samples on MalwareBazaar
TLSH T11593F803F481E0F1C0A22BB137C15761E7FD9E79BC7A8D5AEF4C48856DE268B6B12442
Reporter abuse_ch
Tags:exe Pony


Avatar
abuse_ch
Pony C2:
http://tor.browser.ideaprog.download/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://tor.browser.ideaprog.download/ https://threatfox.abuse.ch/ioc/190039/
http://tor.browser.ideaprog.download/gates.php https://threatfox.abuse.ch/ioc/190040/

Intelligence

File Origin
# of uploads :
1
# of downloads :
607
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
F2945753C6CEDF8E7B8E8F4E04859591C3EDF18C7652A.exe
Verdict:
Malicious activity
Analysis date:
2021-08-16 07:52:27 UTC
Tags:
trojan pony fareit stealer
Link:
https://app.any.run/tasks/3c4795bd-3364-4a17-9270-be48d7c353c5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
pony
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179440/
Detection(s):
Win.Trojan.PonyStealer-9831667-0
Create hunting rule

Win.Trojan.Fareit-403
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Reading critical registry keys
DNS request
Connection attempt
Sending an HTTP POST request
Sending a UDP request
Sending an HTTP GET request
Stealing user critical data
Brute forcing passwords of local accounts
Malware family:
Pony
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/379ea52b-dda7-4c74-a7a0-68aaefddb490
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/833346
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: SAM Dump to AppData
Sigma detected: Suspicious PowerShell Invocations - Specific
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file registry)
Behaviour
Behavior Graph:
Download SVG
Detection:
pony
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-19 16:22:53 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kkfou6gz3py464or5hajbmvshb634mmozjkad4xmwwjs2kmzb2a._file
Verdict:
malicious
Label(s):
pony
Create hunting rule
Similar samples:
4fbb201bac972c243d392f1191e76e16d56e01c5ebcea6e826ecc7236e50d37b
Pony
67d1a8ba1ef2b9c0587be869cb25f66a800a64be803b7ef9efdb33e850449ac1
Pony
8774df1f9a77486fdc20558bf75c2fe6d03eee645addf0cb92b418da7f2971b0
Pony
8bd366c118d422bec6f429e01f24a1b48a4f6a3c2a426e606f0b732bbf457aaf
Pony
92c65b1783392dbe7bd07ff82647439933aabc350020ecfce92e86cb521029fb
Pony
b85943771500d5874e0943b3e641a77bb4345d203e895a75db5f82c62db84b3a
Pony
c710fe6c6193b4b8f439d9ea2592a52e3db0aa9066a5738834f3129352064f2d
Pony
+ 302 additional samples on MalwareBazaar
Result
Malware family:
pony
Create hunting rule
Score:
  10/10
Tags:
family:pony discovery rat spyware stealer suricata
Link:
https://tria.ge/reports/210816-epeareh7zn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Pony,Fareit
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
Malware Config
C2 Extraction:
http://tor.browser.ideaprog.download/gates.php
http://tor.browser.ideaprog.download
Unpacked files
SH256 hash:
f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874
MD5 hash:
30a1f73357e2088bdda8c95c2dda0eac
SHA1 hash:
60f058765cde196581d5d20ec47fbb045a51cdbb
Detections:
win_pony_auto
Create hunting rule
win_pony_g0
Create hunting rule
Link:
https://www.unpac.me/results/0c29db71-01be-4224-b242-048715f638d1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/f2945753c6cedf8e7b8e8f4e04859591c3edf18c7652a00f9765ac99694cc874

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:win_pony_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.pony.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179440/

Comments