analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Весь пакет документов на проверку.eml

Full analysis: https://app.any.run/tasks/fad1d591-795f-4f75-bc5f-08c522a1bd9d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: October 14, 2019, 10:42:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
loader
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

BDCBD912EA0D8610CC31455BBCB2BF98

SHA1:

EAC89983F19674B3C25D25FB22367DFC4983729E

SHA256:

39F474A566C28027A956C633EDF7E44865EF67356EB581B6FC1039B6F5FFBA39

SSDEEP:

1536:lltH6tT9tP5I4Fom8+/KcJ/f68iSU3vZNl7a/YleWi0r6mcyqoFWXRY4ZRKwkC8:pg9XAL+/7H684BNl7aue/bDoFYf+v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Весь пакет документов за сегодня.exe (PID: 4048)
      • Весь пакет документов за сегодня.exe (PID: 836)
    • PONY was detected

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Detected Pony/Fareit Trojan

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Connects to CnC server

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Downloads executable files from IP

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Downloads executable files from the Internet

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Actions looks like stealing of personal data

      • Весь пакет документов за сегодня.exe (PID: 836)
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2644)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1944)
    • Searches for installed software

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2644)
    • Starts CMD.EXE for self-deleting

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Starts CMD.EXE for commands execution

      • Весь пакет документов за сегодня.exe (PID: 836)
    • Connects to server without host name

      • Весь пакет документов за сегодня.exe (PID: 836)
  • INFO

    • Application was crashed

      • Весь пакет документов за сегодня.exe (PID: 4048)
      • Весь пакет документов за сегодня.exe (PID: 836)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start outlook.exe winrar.exe весь пакет документов за сегодня.exe #PONY весь пакет документов за сегодня.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2644"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Весь пакет документов на проверку.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8UNF9L6U\Весь пакет документов за сегодня.001"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
4048"C:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
836"C:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exe" dfsrC:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exe
Весь пакет документов за сегодня.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
2576cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exe"C:\Windows\system32\cmd.exeВесь пакет документов за сегодня.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3324ping 127.0.0.1 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 393
Read events
1 782
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
27
Unknown types
1

Dropped files

PID
Process
Filename
Type
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA7E3.tmp.cvr
MD5:
SHA256:
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8UNF9L6U\Весь пакет документов за сегодня (2).001\:Zone.Identifier:$DATA
MD5:
SHA256:
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:07E8AC2E85FAF0B23DCA42806E485EAB
SHA256:921DBB36BF649CCC1D20C74E9F4AA3D2215D247A2B391703EF2D26BD9707961C
2644OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:7F9F029142D85D6C755C60A74EDC1D12
SHA256:00C58C3D6A36E2A02C90919E348363FE1CF03F6A195C1665D20BEBE032FD5740
1944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1944.27523\Весь пакет документов за сегодня.exeexecutable
MD5:608750B1779C67BB598737690140B09E
SHA256:F38C795EA17880BE245A351E07EAFCF85D8B47DFCD5C51161E3D8D73F86D29B1
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8UNF9L6U\Весь пакет документов за сегодня.001compressed
MD5:E44860BF54C4D360E30C89763FBFE224
SHA256:316853FF43226C6BB188EA090E0B9090D44A41F056ED8C25A3FD207607623288
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8UNF9L6U\Весь пакет документов за сегодня (2).001compressed
MD5:E44860BF54C4D360E30C89763FBFE224
SHA256:316853FF43226C6BB188EA090E0B9090D44A41F056ED8C25A3FD207607623288
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_52A3AE2308170947808D9567A3E6488B.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_68D91219C84C964992535B9AF464ACEE.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
2644OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_FFE18E6B2B43CB4E88C022C5AA06761C.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2644
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
836
Весь пакет документов за сегодня.exe
POST
185.203.119.169:80
http://185.203.119.169/g_38472341.php
BG
malicious
836
Весь пакет документов за сегодня.exe
GET
200
185.203.119.169:80
http://185.203.119.169/index.php?id=0&un=61646d696e&cn=555345522d5043
BG
executable
97.0 Kb
malicious
836
Весь пакет документов за сегодня.exe
POST
185.203.119.169:80
http://185.203.119.169/g_38472341.php
BG
malicious
836
Весь пакет документов за сегодня.exe
GET
200
185.203.119.169:80
http://185.203.119.169/index.php?id=0&un=61646d696e&cn=555345522d5043
BG
executable
97.0 Kb
malicious
836
Весь пакет документов за сегодня.exe
POST
185.203.119.169:80
http://185.203.119.169/g_38472341.php
BG
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2644
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
185.203.119.169:80
BelCloud Hosting Corporation
BG
malicious
836
Весь пакет документов за сегодня.exe
185.203.119.169:80
BelCloud Hosting Corporation
BG
malicious
836
Весь пакет документов за сегодня.exe
34.206.50.228:443
api.blockcypher.com
Amazon.com, Inc.
US
malicious
104.16.54.3:443
blockchain.info
Cloudflare Inc
US
shared
836
Весь пакет документов за сегодня.exe
104.16.54.3:443
blockchain.info
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
blockchain.info
  • 104.16.54.3
  • 104.16.55.3
shared
api.blockcypher.com
  • 34.206.50.228
  • 54.164.0.55
whitelisted

Threats

PID
Process
Class
Message
836
Весь пакет документов за сегодня.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
ET CURRENT_EVENTS WinHttpRequest Downloading EXE
836
Весь пакет документов за сегодня.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
ET TROJAN Pony DLL Download M2
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
MALWARE [PTsecurity] Pony encrypted POST Data Request
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
MALWARE [PTsecurity] Pony encrypted POST Data Request
836
Весь пакет документов за сегодня.exe
A Network Trojan was detected
ET CURRENT_EVENTS WinHttpRequest Downloading EXE
836
Весь пакет документов за сегодня.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
No debug info