contagio malware exchange: Pony

About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.

Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.

With just strings, not exactly a fun blog to read but might become s useful resource over time.

I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find

P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Showing posts with label Pony. Show all posts

Monday, November 17, 2014

iWimMQLgpsT2624529381479181764.png Java Alienspy+pony loader strings

File: iWimMQLgpsT2624529381479181764.png
MD5: fab8de636d6f1ec93eeecaade8b9bc68
Size: 755017

Pony Loader dropped .bat file 3880eeb1c736d853eb13b44898b718ab strings

File: 13648031.bat
MD5: 3880eeb1c736d853eb13b44898b718ab
Size: 94

Ascii Strings:
---------------------------------------------------------------------------
:ktk
del
%1
if
exist
%1
goto
ktk
del
%0

Unicode Strings:
---------------------------------------------------------------------------

Pony Loader strings asdqw4727319084772952101234.exe b5e7cd42b45f8670adaf96bbca5ae2d0

File: asdqw4727319084772952101234.exe
MD5: b5e7cd42b45f8670adaf96bbca5ae2d0
Size: 792122