URL:

http://bit.ly/2RRBx2L

Full analysis: https://app.any.run/tasks/62370518-9c72-4d33-8e7c-74b56b61bd65
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: January 17, 2019, 15:26:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
opendir
Indicators:
MD5:

FF9917E13661BC495CA62B78960697EB

SHA1:

034BAA52E70714023353D72953C57B07FA2F3547

SHA256:

41C96097E19E1E2690385D859370957BC8D67DCF40B9DF42227FB0CCF75CBC1E

SSDEEP:

3:N1KcQ9T3Tn:CcY3T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • invoice00300.scr (PID: 2172)
      • invoice00300.scr (PID: 2380)
      • invoice00300.scr (PID: 1020)
      • invoice00300.scr (PID: 2364)
      • invoice00300.scr (PID: 1884)
      • invoice00300.scr (PID: 3748)
      • invoice00300.scr (PID: 864)
      • invoice00300.scr (PID: 2708)
      • invoice00300.scr (PID: 3644)
      • invoice00300.scr (PID: 4000)
      • invoice00300.scr (PID: 2948)
      • invoice00300.scr (PID: 2472)

    • Detected Pony/Fareit Trojan

      • invoice00300.scr (PID: 2364)

    • Connects to CnC server

      • invoice00300.scr (PID: 2380)
      • invoice00300.scr (PID: 2364)
      • invoice00300.scr (PID: 3748)

    • PONY was detected

      • invoice00300.scr (PID: 2380)
      • invoice00300.scr (PID: 3748)

    • Actions looks like stealing of personal data

      • invoice00300.scr (PID: 2380)
      • invoice00300.scr (PID: 2364)
      • invoice00300.scr (PID: 3748)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • WinRAR.exe (PID: 3868)
      • invoice00300.scr (PID: 2172)
      • invoice00300.scr (PID: 1020)
      • WinRAR.exe (PID: 4060)
      • invoice00300.scr (PID: 1884)
      • invoice00300.scr (PID: 864)
      • invoice00300.scr (PID: 2708)

    • Application launched itself

      • invoice00300.scr (PID: 2172)
      • invoice00300.scr (PID: 1020)
      • WinRAR.exe (PID: 4060)
      • invoice00300.scr (PID: 1884)
      • invoice00300.scr (PID: 864)
      • invoice00300.scr (PID: 2708)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3868)
      • WinRAR.exe (PID: 1872)
      • WinRAR.exe (PID: 4060)

    • Starts CMD.EXE for commands execution

      • invoice00300.scr (PID: 2380)
      • invoice00300.scr (PID: 2364)
      • invoice00300.scr (PID: 3748)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2972)

    • Application launched itself

      • chrome.exe (PID: 2972)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
32
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe invoice00300.scr no specs invoice00300.scr no specs chrome.exe no specs chrome.exe no specs #PONY invoice00300.scr chrome.exe no specs #PONY invoice00300.scr cmd.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs winrar.exe invoice00300.scr no specs winrar.exe #PONY invoice00300.scr explorer.exe no specs cmd.exe no specs invoice00300.scr no specs invoice00300.scr no specs invoice00300.scr no specs invoice00300.scr no specs invoice00300.scr no specs invoice00300.scr no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=896,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=66F8D7A337601732A68AD395D7B0A46E --mojo-platform-channel-handle=760 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
864"C:\Users\admin\Desktop\invoice00300.scr" /SC:\Users\admin\Desktop\invoice00300.scr—explorer.exe
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\desktop\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1020"C:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36683\invoice00300.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36683\invoice00300.scr—WinRAR.exe
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia3868.36683\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1324"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=896,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=8A06F70D374E981BF1B0C8A1342079BF --mojo-platform-channel-handle=948 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1872"C:\Program Files\WinRAR\WinRAR.exe" -elevate4060C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1884"C:\Users\admin\AppData\Local\Temp\Rar$DIa4060.856\invoice00300.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa4060.856\invoice00300.scr—WinRAR.exe
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia4060.856\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2172"C:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36254\invoice00300.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36254\invoice00300.scr—WinRAR.exe
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia3868.36254\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2364C:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36254\invoice00300.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36254\invoice00300.scr
invoice00300.scr
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia3868.36254\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2380C:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36683\invoice00300.scr" /SC:\Users\admin\AppData\Local\Temp\Rar$DIa3868.36683\invoice00300.scr
invoice00300.scr
User:
admin
Company:
ISLANDISH9
Integrity Level:
MEDIUM
Description:
RUSTICIZE10
Exit code:
0
Version:
9.02.0009
Modules
Images
c:\users\admin\appdata\local\temp\rar$dia3868.36683\invoice00300.scr
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=896,6446415706175171745,7615301987602728214,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=B0862AAA518506E1906E8484114F4239 --mojo-platform-channel-handle=3476 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
3 039
Read events
2 892
Write events
143
Delete events
4

Modification events

(PID) Process:(2932) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2972-13192212421186500
Value:
259
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(2972) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2972-13192212421186500
Value:
259
(PID) Process:(2972) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
6
Suspicious files
66
Text files
115
Unknown types
8

Dropped files

PID
Process
Filename
Type
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b37eb127-4563-4bbe-b483-11390cb7d5b5.tmp —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fc6e831e-f0e7-414f-a2d8-09b3acee7960.tmp —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF199800.TMPtext
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Temp\Cab9CA4.tmp —
MD5:—
SHA256:—
2972chrome.exeC:\Users\admin\AppData\Local\Temp\Tar9CA5.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
28
DNS requests
17
Threats
35

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2972
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAU5fm3dSuY9dJCdoTinHgw%3D
US
der
471 b
whitelisted
2380
invoice00300.scr
GET
404
198.54.114.232:80
http://b.asianexpltd.com/shit.exe
US
html
325 b
malicious
2364
invoice00300.scr
POST
—
198.54.114.232:80
http://b.asianexpltd.com/gate.php
US
—
—
malicious
3748
invoice00300.scr
POST
—
198.54.114.232:80
http://b.asianexpltd.com/gate.php
US
—
—
malicious
2972
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2972
chrome.exe
GET
301
67.199.248.11:80
http://bit.ly/2RRBx2L
US
html
150 b
shared
2364
invoice00300.scr
GET
404
198.54.114.232:80
http://b.asianexpltd.com/shit.exe
US
html
325 b
malicious
2972
chrome.exe
GET
301
67.199.248.11:80
http://bit.ly/2RRBx2L
US
html
150 b
shared
2380
invoice00300.scr
POST
—
198.54.114.232:80
http://b.asianexpltd.com/gate.php
US
—
—
malicious
3748
invoice00300.scr
GET
404
198.54.114.232:80
http://b.asianexpltd.com/shit.exe
US
html
325 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
chrome.exe
67.199.248.11:80
bit.ly
Bitly Inc
US
shared
2972
chrome.exe
172.217.21.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2972
chrome.exe
172.217.18.99:443
www.gstatic.com
Google Inc.
US
whitelisted
2972
chrome.exe
172.217.22.109:443
accounts.google.com
Google Inc.
US
whitelisted
2972
chrome.exe
162.125.66.1:443
www.dropbox.com
Dropbox, Inc.
DE
shared
2972
chrome.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2972
chrome.exe
162.125.66.6:443
ucaf5897b7bda1a989aebf7b8ba7.dl.dropboxusercontent.com
Dropbox, Inc.
DE
shared
2972
chrome.exe
172.217.18.14:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2972
chrome.exe
74.125.206.99:443
www.google.com
Google Inc.
US
whitelisted
2380
invoice00300.scr
198.54.114.232:80
b.asianexpltd.com
Namecheap, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.gstatic.com
  • 172.217.18.99
whitelisted
bit.ly
  • 67.199.248.11
  • 67.199.248.10
shared
clientservices.googleapis.com
  • 172.217.21.195
whitelisted
accounts.google.com
  • 172.217.22.109
shared
www.dropbox.com
  • 162.125.66.1
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ucaf5897b7bda1a989aebf7b8ba7.dl.dropboxusercontent.com
  • 162.125.66.6
malicious
sb-ssl.google.com
  • 172.217.18.14
whitelisted
ssl.gstatic.com
  • 172.217.18.99
whitelisted
www.google.com
  • 74.125.206.99
  • 74.125.206.103
  • 74.125.206.104
  • 74.125.206.147
  • 74.125.206.105
  • 74.125.206.106
malicious

Threats

PID
Process
Class
Message
2364
invoice00300.scr
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2364
invoice00300.scr
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2364
invoice00300.scr
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
2364
invoice00300.scr
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2380
invoice00300.scr
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2380
invoice00300.scr
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2380
invoice00300.scr
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
2380
invoice00300.scr
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
2380
invoice00300.scr
A Network Trojan was detected
ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98
2380
invoice00300.scr
A Network Trojan was detected
MALWARE [PTsecurity] Fareit/Pony Downloader Checkin
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://bit.ly/2RRBx2L