MALICIOUS — ae0b00f1b014d3902edc770dda0d612e237d90f63982343dfd1edeb4138533e2

MALICIOUS — ae0b00f1b014d3902edc770dda0d612e237d90f63982343dfd1edeb4138533e2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PonyStealer family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: ae0b00f1b014d3902edc770dda0d612e237d90f63982343dfd1edeb4138533e2
• SHA-1: fab0ee90bbba58d87d8fbc6dc6e2fca5d6bf7957
• MD5: e67e2333c8d825a7a16aff73efad6e65
• imphash: d467d1e8f831f3612b7a932cf591ae45
• ssdeep: 1536:ZopySMphuESsm2rnDeAx7vukVySXq/fiTvlATmeX4Z4R4H4i4/o9FKs0z2xoetE:9JNlHeABvuYyucz9/tBH3H3e
• TLSH: T13C4664ED9618C819F0A7F05F09215CED1BDED22602B644D43D27AB8D61C64732C6EA3E
• Submitted as: ae0b00f1b014d3902edc770dda0d612e237d90f63982343dfd1edeb4138533e2
• File type: pe · Size: 295424 bytes
• Verdict: malicious (100/100) · Family: PonyStealer

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.VB-1144
• Microsoft Defender: Worm:Win32/Vobfus.AC
• Emsisoft (Emergency Kit): Gen:Heur.PonyStealer.sq3@CqkCTGci
• Trellix Stinger (McAfee): Downloader-CJX.gen.g
• Kaspersky (KVRT): Worm.Win32.VBNA.alkx

MITRE ATT&CK

• T1547.001
• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Trojan.VB-1144 (rule Win.Trojan.VB-1144) - engine signal, weight 0.90, confidence 0.95
• 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Worm:Win32/Vobfus.AC (rule Worm:Win32/Vobfus.AC) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Heur.PonyStealer.sq3@CqkCTGci (rule Gen:Heur.PonyStealer.sq3@CqkCTGci) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Downloader-CJX.gen.g (rule Downloader-CJX.gen.g) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.VBNA.alkx (rule Worm.Win32.VBNA.alkx) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

24855 behavior events · 3 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ns1.theimageparlour.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• edgedl.me.gvt1.com
• desktop-hsgcbep
• login.live.com
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com

Dropped files

• C:\Users\analyst\fokex.exe - cc3386d9018ca8d44b0c7763494d61b0300c0d345c1061a51358b4d23eff16c2
• 7ce8288b70f69267f1c81e4f112d253306c9bfc9b50b93e3797b3f5b6a39b88e - 7ce8288b70f69267f1c81e4f112d253306c9bfc9b50b93e3797b3f5b6a39b88e
• 96b02e4ac004c1f93d5b2ae4b1be583cbd80d4b845536b02c93cafdc496adb31 - 96b02e4ac004c1f93d5b2ae4b1be583cbd80d4b845536b02c93cafdc496adb31
• b4d97e6a32b88c6498af4aa7af9551d64df329e77a21d2f901f4ce724979c64c - b4d97e6a32b88c6498af4aa7af9551d64df329e77a21d2f901f4ce724979c64c

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788333251&P2=404&P3=2&P4=QVURHWLmjXiPSY8rNbO4FBy8rT5LqY%2fLswrP9JQQFpQ%2fLj8RTXuTbMhkYVZ%2bn4WUfA%2bV2LMpYYBqVhXM2issEQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• ns1.theimageparlour.net
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• oneclient.sfx.ms

Embedded IP addresses

• 20.42.73.28
• 52.253.84.76
• 4.230.171.124
• 57.155.104.224
• 20.165.94.54
• 4.247.188.233
• 40.79.167.9
• 135.233.95.144
• 74.179.77.204
• 52.123.252.227
• 52.110.12.2
• 34.104.35.123
• 48.192.143.121
• 4.150.223.97
• 172.178.240.161
• 52.168.117.175
• 203.26.79.13
• 52.148.114.188
• 40.84.97.4
• 4.150.223.110
• 48.211.4.16
• 104.208.16.94
• 40.84.85.40
• 52.123.129.14
• 85.210.193.152

More PonyStealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report