analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Tender_0086365327_output5AFA060.ace

Full analysis: https://app.any.run/tasks/5a6c5b04-4d96-460f-9d8c-5e2990b37097
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: December 06, 2018, 08:08:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0239B0165560AA691D12DB490387EE57

SHA1:

665A6D17079B3277A36D45DDA79D29E3C4C4B55C

SHA256:

429811EF7FF2D0F3B94135FFF17C612A8CA3A9F2968B5EB739AC6224CD9A5E99

SSDEEP:

3072:5TnfG/uqF/kz4TqhDudsX8k7xO0+3xP/isYILBcc16keU6TpkEbZotCfSzo:xW/kUcuU/7xOB3rlcc4DU6TCooAfSzo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • win73.bat (PID: 3100)
      • Tender_0086365327_output5AFA060.bat (PID: 2784)
      • Tender_0086365327_output5AFA060.bat (PID: 2528)
      • win73.bat (PID: 2396)

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2956)

    • Detected Pony/Fareit Trojan

      • win73.bat (PID: 2396)

    • Actions looks like stealing of personal data

      • win73.bat (PID: 2396)

  • SUSPICIOUS

    • Suspicious files were dropped or overwritten

      • WinRAR.exe (PID: 2728)
      • Tender_0086365327_output5AFA060.bat (PID: 2784)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2728)
      • Tender_0086365327_output5AFA060.bat (PID: 2784)

    • Starts itself from another location

      • Tender_0086365327_output5AFA060.bat (PID: 2784)

    • Executes scripts

      • Tender_0086365327_output5AFA060.bat (PID: 2784)

    • Starts application with an unusual extension

      • WinRAR.exe (PID: 2728)
      • Tender_0086365327_output5AFA060.bat (PID: 2784)
      • win73.bat (PID: 3100)

    • Creates files in the user directory

      • notepad++.exe (PID: 2844)

    • Application launched itself

      • win73.bat (PID: 3100)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
8
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe tender_0086365327_output5afa060.bat wscript.exe win73.bat no specs notepad++.exe gup.exe #PONY win73.bat tender_0086365327_output5afa060.bat no specs

Process information

PID
CMD
Path
Indicators
Parent process
2728"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Tender_0086365327_output5AFA060.ace"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2784"C:\Users\admin\AppData\Local\Temp\Rar$DIa2728.25165\Tender_0086365327_output5AFA060.bat" C:\Users\admin\AppData\Local\Temp\Rar$DIa2728.25165\Tender_0086365327_output5AFA060.bat
WinRAR.exe
User:
admin
Company:
Oximation5
Integrity Level:
MEDIUM
Description:
SAPOROUS1
Exit code:
0
Version:
3.04.0007
2956"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\win73.vbs" C:\Windows\System32\WScript.exe
Tender_0086365327_output5AFA060.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3100"C:\Users\admin\AppData\Local\Temp\subfolder\win73.bat" C:\Users\admin\AppData\Local\Temp\subfolder\win73.bat—Tender_0086365327_output5AFA060.bat
User:
admin
Company:
Oximation5
Integrity Level:
MEDIUM
Description:
SAPOROUS1
Exit code:
0
Version:
3.04.0007
2844"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Tender_0086365327_output5AFA060.bat"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
4012"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
2396C:\Users\admin\AppData\Local\Temp\subfolder\win73.bat" C:\Users\admin\AppData\Local\Temp\subfolder\win73.bat
win73.bat
User:
admin
Company:
Oximation5
Integrity Level:
MEDIUM
Description:
SAPOROUS1
Version:
3.04.0007
2528"C:\Users\admin\Desktop\Tender_0086365327_output5AFA060.bat" C:\Users\admin\Desktop\Tender_0086365327_output5AFA060.bat—explorer.exe
User:
admin
Company:
Oximation5
Integrity Level:
MEDIUM
Description:
SAPOROUS1
Version:
3.04.0007
Total events
881
Read events
847
Write events
34
Delete events
0

Modification events

(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2728) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Tender_0086365327_output5AFA060.ace
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2728) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(2728) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
2
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2728WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2728.27071\Tender_0086365327_output5AFA060.bat —
MD5:—
SHA256:—
2728WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2728.25165\Tender_0086365327_output5AFA060.batexecutable
MD5:5E9A9FC99CDE79C5F011D8540B972F83
SHA256:30D7E35ED53ADDFC42E01A00471D1144057E7C415EA9FF1E42AA0F5F322F56C8
3100win73.batC:\Users\admin\AppData\Local\Temp\~DF3109DC1F7AC6EB06.TMPbinary
MD5:310151E47EA53BDDBEE629E4FAEACD14
SHA256:A514DB8930F7AF78FA3A96E8BE537B4F8FF9F2760B3C895C55ACDDCA9C467D29
2784Tender_0086365327_output5AFA060.batC:\Users\admin\AppData\Local\Temp\~DFAA54CB3835136320.TMPbinary
MD5:310151E47EA53BDDBEE629E4FAEACD14
SHA256:A514DB8930F7AF78FA3A96E8BE537B4F8FF9F2760B3C895C55ACDDCA9C467D29
2844notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:32546B45C07102294F6C077B0EBCA1CD
SHA256:4608818546680211CD42E327BD69ADDE07B84B8484A17B8974A73A099D75F1DA
2784Tender_0086365327_output5AFA060.batC:\Users\admin\AppData\Local\Temp\subfolder\win73.batexecutable
MD5:5E9A9FC99CDE79C5F011D8540B972F83
SHA256:30D7E35ED53ADDFC42E01A00471D1144057E7C415EA9FF1E42AA0F5F322F56C8
2784Tender_0086365327_output5AFA060.batC:\Users\admin\AppData\Local\Temp\subfolder\win73.vbstext
MD5:686834CB30CCD8E2B72B3ED1FA2A07C4
SHA256:41483F21F5DEC90B387180ECC0A43DB95FD0301EFC9B9849C09505906591B141
2844notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:A94DC1C48FB1F210ADD53E8DCE487FDC
SHA256:DDB1CDE773CF231371FC986A14E615DCC9B7B2BCE34366F1B480768E199D3F5C
2844notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xmltext
MD5:AD21A64014891793DD9B21D835278F36
SHA256:C24699C9D00ABDD510140FE1B2ACE97BFC70D8B21BF3462DED85AFC4F73FE52F
2844notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:E792264BEC29005B9044A435FBA185AB
SHA256:5298FD2F119C43D04F6CF831F379EC25B4156192278E40E458EC356F9B49D624
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
win73.bat
POST
—
162.144.36.116:80
http://masariqroup.com/kabospy/gate.php
US
—
—
malicious
—
—
GET
200
2.16.106.80:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
unknown
der
471 b
whitelisted
—
—
GET
200
2.16.106.80:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D
unknown
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4012
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
—
—
2.16.106.80:80
ocsp.usertrust.com
Akamai International B.V.
—
whitelisted
2396
win73.bat
162.144.36.116:80
masariqroup.com
Unified Layer
US
suspicious

DNS requests

Domain
IP
Reputation
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
ocsp.usertrust.com
  • 2.16.106.80
  • 2.16.106.50
whitelisted
masariqroup.com
  • 162.144.36.116
malicious

Threats

PID
Process
Class
Message
2396
win73.bat
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
2396
win73.bat
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Tender_0086365327_output5AFA060.ace