File name:

maersk line Invoice.ace

Full analysis: https://app.any.run/tasks/5923b739-f44c-4788-8d73-2be9d763b98f
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 09:58:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
opendir
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid
MD5:

93770456A7AA7D63D7E93C0B12A5B13D

SHA1:

9FFAE93C6A202A7C27EC55A84F171A8697ECF742

SHA256:

95826A2CC416A7AA06A68D653B11541AAC03340BE4B41771284FB53CABEC6103

SSDEEP:

6144:7Ry++t+r5YY0KlVycHMEp6Prnrmuq0Xq2YnuByuFH7pkWuJWecI7Hd2Y:7Ry++talVycRI+uqlRuo8H7pkIeNoY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • maersk line Invoice.exe (PID: 2688)
      • maersk line Invoice.exe (PID: 3856)

    • Detected Pony/Fareit Trojan

      • maersk line Invoice.exe (PID: 3856)

    • Connects to CnC server

      • maersk line Invoice.exe (PID: 3856)

    • Actions looks like stealing of personal data

      • maersk line Invoice.exe (PID: 3856)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2844)

    • Application launched itself

      • maersk line Invoice.exe (PID: 2688)

    • Reads Internet Cache Settings

      • maersk line Invoice.exe (PID: 3856)

    • Starts CMD.EXE for commands execution

      • maersk line Invoice.exe (PID: 3856)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe maersk line invoice.exe no specs #PONY maersk line invoice.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284cmd /c ""C:\Users\admin\AppData\Local\Temp\2181265.bat" "C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exe" "C:\Windows\system32\cmd.exe—maersk line Invoice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2688"C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2844.5654\maersk line invoice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\maersk line Invoice.ace"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3856"C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exe
maersk line Invoice.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2844.5654\maersk line invoice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
810
Read events
783
Write events
27
Delete events
0

Modification events

(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\maersk line Invoice.ace
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0
Operation:writeName:Count
Value:
0
(PID) Process:(2844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0
Operation:writeName:Name
Value:
542D4B42647265644B76737A7E794B566767537663764B5B7874767B4B43727A674B7A767265647C377B7E7972375E7961787E747239767472171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171700
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3856maersk line Invoice.exeC:\Users\admin\AppData\Local\Temp\2181265.bat —
MD5:—
SHA256:—
2844WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2844.5654\maersk line Invoice.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3856
maersk line Invoice.exe
POST
—
89.41.173.149:80
http://king-businesssell.top/austin/pony/gate.php
RO
—
—
malicious
3856
maersk line Invoice.exe
GET
404
89.41.173.149:80
http://king-businesssell.top/austin/pony/shit.exe
RO
html
337 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3856
maersk line Invoice.exe
89.41.173.149:80
king-businesssell.top
Ch-net S.r.l.
RO
malicious

DNS requests

Domain
IP
Reputation
king-businesssell.top
  • 89.41.173.149
malicious

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3856
maersk line Invoice.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
3856
maersk line Invoice.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
3856
maersk line Invoice.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.
3856
maersk line Invoice.exe
A Network Trojan was detected
ET TROJAN Trojan Generic - POST To gate.php with no referer
3856
maersk line Invoice.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3856
maersk line Invoice.exe
A Network Trojan was detected
MALWARE [PTsecurity] Pony encrypted POST Data Request
3856
maersk line Invoice.exe
A Network Trojan was detected
ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98
3856
maersk line Invoice.exe
A Network Trojan was detected
MALWARE [PTsecurity] Fareit/Pony Downloader Checkin
3856
maersk line Invoice.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 3
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
maersk line Invoice.ace