For what it worth.
usage: python2 pony.py malware.bin
vb6 version: https://github.com/Xyl2k/Pony-gate-extractor
so far here are some results from it:
Code: Select all
required to pip install validators if you don't have it already.import argparse
import validators
def get_gate(f):
gate = ''
pe = f.read()
print len(pe)
if len(pe) >= 63000 and len(pe) <= 100000:
i = pe.find('YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0') - 3
if i > 0:
while pe[i] != '\x00' and i >= 0:
gate = pe[i] + gate
i -= 1
return gate
parser = argparse.ArgumentParser(description='Extract Pony binary gate.')
parser.add_argument('FILE', type=argparse.FileType('rb'), help='Pony binary')
args = parser.parse_args()
gate = get_gate(args.FILE)
if validators.url(gate):
print gate
else:
print 'Gate not found!'usage: python2 pony.py malware.bin
vb6 version: https://github.com/Xyl2k/Pony-gate-extractor
so far here are some results from it:
Code: Select all
GATE - MD5 Sample
hxxp://humade.kr/backup/pc/gate.php 769203859c36e7ed43efda07ac225660
hxxp://allverdantgroup.tk/xml/Panel/gate.php 7e46cb6375b993e1aa3dfb51989b8d34
hxxp://elfmakine.com/turkphp/gate.php d55af245b2121021c266e519e364839c
hxxp://naresusexports.com/cs/gate.php eb6a663833d81c3fb6ec63f1b32b19ee
hxxp://wisetoolz.com/flamez/gate.php cc0094e0b612bbf330a627cccf274c0d
hxxp://gpdi-lippocikarang.com/dd/gate.php 72aa5a0823c70655ba8960051a18cecc
hxxp://divdal2.no-ip.org/pony/gate.php f90729d563b9f796cb8fba7cba86c468
hxxp://gpdi-lippocikarang.com/ewipon/gate.php 7f553b4d8f794aee64d8cffd133d7ced
hxxp://clone147.com/enough/gate.php b8fdd93a37b13248c9d994fa52ba0e69
hxxp://mainserver.com/gate.php 6444ce04981647db11e3681f6571cdea
hxxp://screensgame.ru//gate.php b844ffd6d08d467609bf3dfa90d8afa4
hxxp://bebravse.bget.ru/pony/gate.php cebde8133fe20ca19a9518c495bbb0be
hxxp://localhost/panel/gate.php d1a6b953c579f22cf818419f0230d9c8
hxxp://currieew.com/goal/gate.php d8621b15e366216fd0e7fabc884898c4
hxxp://steelyieh.com/imager/gate.php a0f09577c12559e73211dcef4087fb92
hxxp://bardelierro.site88.net/panel/gate.php 4f841e0631828338dfa2cf5feaa25e05
hxxp://speclessinc.com/kumasi/Server/gate.php dd333cd0976543df07abf870e35f1593
hxxp://powerhouseinc.ru/seniorman/Server/gate.php 7ee7d445b27492c1e03c2288eebc9eea
hxxp://garvrelslinkz.ru/gate.php bd1f6bb25e5e9b5e1112590489811101
hxxp://wert1234ua.comli.com/gate.php 4d7a4563128bcd6321e56750ed7173ed
hxxp://cyclonemousery.com.au/definitions/available/bravest/gate.php 54a7f7fb50e7757c73afd82ca46ff3ed
hxxp://silvcor.es/kalu/gate.php 9f96e1d71f643b56261fb27de4bbac5c
hxxp://econnector.us.to/ml/vrs/oj334/panel/gate.php 90e78f8a061e9442aa6efcaee1c55192
hxxp://adobecss.su/host/gate.php ee1455d1acfb3221c782dc8a100a9985
hxxp://www.dambrozalturasbohol.su/gate.php 354d3debb16f177d01c787adfefc2378
hxxp://danhviet.com.vn/downloader/main/gate.php 672a5f7204688a47daf5dafc010ccad9
hxxp://31.220.22.52/Panel/gate.php bd3bf0a182ca9f3b9bac9c2b9f77f180
hxxp://sharefiles.usa.cc/ml/vrs/ojpn/7/panel/gate.php 738201e2c53020333124aaca1032b304
hxxp://dexo.lt/pvz/uploads/module/pr/gate.php d776aac729ab4d8243a29890e5239c75
hxxp://test.clubcheat.ru/gate.php c280882c70b6ba8cfa31d99aca376b8d
hxxp://andrevinicius.com.br/atualiza/zia_way/gate.php bf25a78b9a7da21d540a05e9aee4f93d
hxxp://pony.me.ht/gate.php 2427f6e583a338251213088081bc489c
hxxp://www.serialabj.com/hamilto/Panel/gate.php 7ad85a1109ef251b6af3fd4c46bf1742
hxxp://gpdi-lippocikarang.com/ema/gate.php 15a74fb0ce0df50a24692c647f2ee29b
hxxp://econnector.usa.cc/ml/vrs/oj336/panel/gate.php cd223268b8a497b9d66e3d447ce32151
hxxp://arienco.tk/enough/gate.php 2fccad8e7eefac3a4bf27a39eab51845
hxxp://www.personalgpstrackingdevicesreview.com/12/gate.php 46777a368abf8f73e2dfe4f1d81352eb
hxxp://juliedclient.org.in/wpany/two-owen25july-25aug/gate.php 397b7d7450761f3e2e28c38013fe1b87
hxxp://devinefavour.com/fighter/Panel/gate.php 88678b0f2c8e42496347ea630583f991
hxxp://212.227.198.222/panel/gate.php 4f8d5a734850b87b471ac07914647eb5
hxxp://185.32.182.20/images/14aaa/gate.php 08aa9fa84886c6b0e36f37f26d30e720
hxxp://bhf.su/gate.php b6064f87f21bec7dba9e1e9c665cf714
hxxp://vovik.ho.ua/gate.php 14c1921ce49b39028144e7ce6eff6b21
hxxp://intrige2.bget.ru/gate.php 895ff301c610ece2e89cdda3fe359fe3
hxxp://www.teachgalaxy.site/jollybiz/newpanel/gate.php f1ff29fd0e7fca7f46b94cc4ecb300f0
hxxp://secureaccount.ru/pony2/gate.php 83aecfd4ae8f0b169e577468fdbd2f02
hxxp://webersmokeymountaincookerreview.com/forum/viewtopic.php f5846b2095d2247c855bb39c67f4c5d9
hxxp://ahmed1337.in/index/html/gate.php 4685eac90faa8f0e553edf71186a61bb
hxxp://beerkingss.com/gate.php 0cf33a3678cd63e0af96b31c2c86f6dd
hxxp://speclessinc.com/rule/Server/gate.php b97c1026439f470763404153425ae744
hxxp://login2.ministryofvapes.com/Panel/gate.php 61b3181b655e9fc4b15debaf448aede5
hxxp://tankioniline-cms.site88.net/panel/gate.php 17f120f096d672be06974bfcd175cb7e
hxxp://megaprimeltd.su/mineops/hcomplet/gate.php 8594790488c82b955e92a9a9320c611f
hxxp://silvcor.es/po/gate.php 5074fa3467c9a0585e784a9872e70fbc
hxxp://polarismontanavacations.com/fatty/gate.php a53568ee1aa89a73d633608c5a6cf3fa
hxxp://sereviewinz.info/afam/Server/gate.php 8ba184e05474f77cc8570c01c13a11bc
hxxp://piko.usa.cc/ml/vrs/ojp2/4/panel/gate.php 6d2d6ecade6e42282fd7708767b80dd2
hxxp://qatar-conect.com/newway/panelnew/gate.php 7c239450435b87d58d8416c515a4dfb9
hxxp://megaprimeltd.su/giga/gate.php 3f4c9abe23aef1f416fcc92abc024bf6
hxxp://vineprincs.com/gate.php 5dc0852ae96135ee490552aef6c9a31d
hxxp://pony19.esy.es/gate.php 3cfc0a4c8fd0b9f3ee222f6a0bdf3011
hxxp://teach4god.com/blog/wp-content/upd.php e1682368ab2171518c33d887b3c0d820
hxxp://dog.fls-g.com/gate.php cfc8cac1e7eeeb6ba0dad22706427614
hxxp://gpdi-lippocikarang.com/digpon/gate.php 13ceb1319f8085f55c3061b281d6d22a
hxxp://199.15.117.139/pony/gate.php c4e9087666f8c332a7901ab5f03381f7
hxxp://vapourfrog.co.uk/dodo/gate.php 61b9596c3a2516e142945fea58ec341d
hxxp://toxhoster.net/forum/gate.php d0b3689a70d9eb59e66a73de3a19c6b7
hxxp://intrige2.bget.ru/gate.php 5c23f324ca93ff23bdf218e31e3ee892
hxxp://ahmed1337.in/phpgate/gate.php 0bf7b18f209ca5b5386d7c4041e1e474
hxxp://tclogs.tk/pon/gate.php 609af9e7c5fbdb89a9e3ead01eae3637
hxxp://mainserver.com/gate.php 5f096cc285f73dcaf7a23b0ce318a2a7
hxxp://46.183.223.228/gate.php cf44914f862e1e559d27a4974976a200
hxxp://obshaga.hostenko.com/kek/gate.php cf23daea452ceed4fbc97bcfd77e674c
hxxp://asusoftware.no-ip.org/pon/gate.php 511c8bafcae9f13446854a67be367699
hxxp://intrige2.bget.ru/gate.php eb515925bc6caea4e5a26a184250fcf9
hxxp://steelyieh.com/imager/gate.php 21b524033c57070c221e4b7ea5e7e1a6
hxxp://macro-flash.nut.cc/ml/vrs/ojp2/4/panel/gate.php 99bbb1bfab57a57d2783838cf5d0e19e
hxxp://newgroundresjournals.org/omada/gate.php 038c05c504272c66ab0959fc803ef7e4
hxxp://dkmes.com/world/gate.php f63da4efee8298c2d149b5df9a6bd149
hxxp://vovik.ho.ua/gate.php 99eef54de7efb4bf610e0906f8b1a541
hxxp://juliedclient.org.in/wzlog/paul-16aug-16sept/gate.php f859296c01e65fde2deaeb995c343ce3
hxxp://microsoftsup.com/Panel/gate.php c3e4754802f64ab650cbd8b3b41da84b
hxxp://caitymccardell.com/wp-content/upd.php 2ecb371d57b0a8f62cf112a4199b6000
hxxp://cx20515.tmweb.ru/panel/gate.php 5e9ab2f6e47ad8b965fb1ee463c8caa0
hxxp://radhajewellary.com/ext/modules/7wa8e.php a3b5e497ee98f0571bd416d919ebda4c
hxxp://vklad.kz/umeh/Server/gate.php 7b4a8b9f3fe0c42c7ce0bc587b9ab2c4
hxxp://ameircanriverintl.com/logs/pony3/gate.php a3adf847f030cd221de81b463f2d4009
hxxp://econnector.us.to/ml/vrs/oj33/panel/gate.php 35a4431ca4a27fad0845e45abb420dbb
hxxp://mainserver.com/gate.php 73dc5c21b35556bc804e5470d0e0ef43
hxxp://danie.publicvm.com:5434/danie/gate.php bf1d805783f265e5603128b0c4bfed72
hxxp://latinoslock.org.in/owenone-25july-25aug/gate.php db2f61ba5398f9eac3271b1a76a6e6dd
hxxp://wep-hack.tk/gate.php 2a48f01ea60a86bab9acfa6f50f82de2
hxxp://piko.usa.cc/ml/vrs/ojp2/3/panel/gate.php bb8b462deceaa4eabce3d5acf8c5848f
hxxp://mainserver.com/gate.php 8677628dc359520aa2d118c3932f5291
hxxp://tymooning.com/panel/gate.php a318d016746b2004452908397040b8c4
hxxp://shopds.ru/Pony/gate.php a407cfb75e939699eaafbc174faa1a34
hxxp://vineprincs.com/gate.php 005fa37880a3b11306cd94bb1bc773d0
hxxp://lmw1ufmph-site.1tempurl.com/lmw1ufmph-site.1tempurl.com/stantech/gate.php 59578b44e7729a4bf9b936d24d0a222a
hxxp://tankioniline-cms.site88.net/panel/gate.php f1e153b13680724ac7bd7ebc83227cbf
hxxp://obshaga.hostenko.com/kek/gate.php 607978db145c590de4dec0294a4b5743
hxxp://sentembertolls.ru/pony/gate.php bc0559265c625ef1c93a645a34682540
hxxp://setgerpder.s-host.net/gfx/gate.php 0e97318a2439a220bc7be9bf79cd6e5a
hxxp://clone147.com/enough/gate.php bf1edb32b1bfa3a6c382bc88939f7ebe
hxxp://gpdi-lippocikarang.com/dodo/gate.php f3a71d6e4d36d0f91285e6135db95b91
hxxp://prim-job.ru/node2/gate.php b8c7da88221583a06cee076d901d93f0
hxxp://secureaccount.ru/pony2/gate.php 60c97e992390cd07a6d27855b7f9eee3
hxxp://TelevisionHunter.com/pizda/gate.php 7011a9154c92df703afc4a4761b7c3a4
hxxp://cyclonemousery.com.au/definitions/available/rapheal/gate.php 604e5e4086085c5ce0a90a954c4b721a
hxxp://test.clubcheat.ru/gate.php f09c4e5d33d450ee13923879a7a9fe4b
hxxp://intrige2.bget.ru/gate.php 81ef30777ef016c28de60dd23eecf09d
hxxp://garvrelslinkz.ru/pony2/gate.php a4704234afbb59595ff62307a231faeb
hxxp://74.53.97.66:8080/forum/viewtopic.php 3d6438d3673112925a6cd8e67fbe8cf3
hxxp://www.ringsun.com.cn/boss/gate.php 3b935fa2c6ee351224b59f05a30fa7b2
hxxp://limco.us.to/ml/vrs/2oj/5/pny/panel/gate.php 5bfab7d01fd23c64f5e5ec2e237bb660
hxxp://c97769io.bget.ru/gate.php 66ee38a7dffe305113900354d0d6b233
hxxp://TelevisionHunter.com/pizda/gate.php 6b0a495990f5c85e482164c6536a59e7
hxxp://vineprincs.com/gate.php 33e9001267eff9501f1337a685bdaf23
hxxp://vapourfrog.co.uk/ema/gate.php 7a566015e4d391bd7256be06de2985bd
hxxp://46.183.223.228/iy3ughljio/gate.php d53c64549844fa50cc87b74fad8af826
hxxp://myp0nysite.ru/gate.php f9de3362c0e7e8cb61c8f96adfbcd999
hxxp://garvrelslinkz.ru/gate.php 21926f20eefd51e1904cc5348f16fe14
hxxp://msa-hinat.net/Rebuild/test/gate.php cc1d4c85dc7ac1d006bbacbdb0a527f6
hxxp://powerhouseinc.ru/uz/Server/gate.php 67e1f6a4012fa400c485b97fdd704e44
hxxp://safehosters.org/my/gate.php 42e177840c831f591e5443f8049839f2
hxxp://piko.usa.cc/ml/vrs/ojp2/4/panel/gate.php aec8a1c8e5bdcd4f24549a27ff1ad08f
hxxp://musiceyecandy.com/default.php?Q59u3ls2JoClFE2ph4fK1U2Yz7b84omjsz 7e02946f4989b3419e32fa4b33c99e16
hxxp://devinefavour.com/Aboki/Panel/gate.php f13b9b905ddec160f0cf732b7727f07b
hxxp://dambrozalturasbohol.su/gate.php cb6ccfad7fb10d399b96af204088024e
hxxp://steelyie.com/Creation/panel/gate.php af43c4a48e1b5808ed2893387176741a
hxxp://www.arienco.tk/enough/gate.php cc7df7c4fdac5dfec47810d3f3166f52
hxxp://gpdi-lippocikarang.com/mypon/gate.php cf9d97c5dc09f1a89c44426fb9391dd7
hxxp://garvrelslinkz.ru/pony3/gate.php be60cb51cbef116913ca50e5693e2694
hxxp://kizi2016wandansa.top/kizi/gate.php ca84582d65616a9ae4d98d4ccf0db670
hxxp://tagmysms.com/kcee/gate.php 2d4ddfe7c37e7512e711c6438fea334e
hxxp://renegale.tk/gate.php a9b4a4055a81118629e0a9e64eb96e5b
hxxp://ameircanriverintl.com/logs/flash/gate.php 9d53bbcf2472d209a40435defb36668e
hxxp://securebanking.ru/ 7de65860dc317e2d34ddb67adc49b27d
hxxp://sntgreen.cl/Font-Awesome/pdf/contact.php a7a675302649ab71eb82c94c95cb1bc0
hxxp://petrovasafety.com/css/PDF/AdobePDF_files/panel/gate.php 6d3da1fd9e5843070bdf6b75452b751f
hxxp://chinoe.publicvm.com:5434/chinoe/gate.php e6f6dbba3db6fd2d0a66d661c6b18a7b
hxxp://www.ringsun.com.cn/boss/gate.php 197325ee920be80b2762eafd227d92d7
hxxp://musiceyecandy.com/default.php?Q59u3ls2JoClFE2ph4fK1U2Yz7b84omjsz 33ddfc0938f780574a35e68f1d04a02a
hxxp://clone147.com/enough/gate.php d82fbce6ac1aaf9a290fedb929f84cee
hxxp://mainserver.com/gate.php 2dce4c2fce0a41973a6e10ab190c8cb9
hxxp://login2.ministryofvapes.com/Panel/gate.php c50de2432cc25efda06f5248de941221
hxxp://cyclonemousery.com.au/definitions/available/rapheal/gate.php afc3b57732a6367970f43c0a346b5089
hxxp://reapcookware.com/Private/archive/gate.php dedbe059a7bb4db7e89bfdb610d834ad
hxxp://ahmed1337.in/phpgate/gate.php abee4867a4424c721c3be0b505ab1b46
hxxp://mainserver.com/gate.php 26c0a6dcf0babd178678e1b3af93e5f5
hxxp://cyclonemousery.com.au/definitions/available/bravest/gate.php e70bbd8b4dd679965a64a8031f6f15b4
hxxp://bebravse.bget.ru/pony/gate.php 0de43d3a38bec21fc622ddf5af8a5341
hxxp://vapourfrog.co.uk/ema/gate.php 31c3a6cdc2256cef2e31e19d550193bf
hxxp://asusoftware.no-ip.org/pon/gate.php 5699d303a4c83b4087ba3d9387f9f8b7
hxxp://tymooning.com/panel/gate.php 18e72a9ad013ba35fd2af1bef759434e
hxxp://ahmed1337.in/index/html/gate.php 118c6bf010eacd3fcfa51338a4458704
hxxp://steelyie.com/Creation/panel/gate.php 8c74feb81712221b806adcf4ff1ae5b0Attachments
infected
(102.49 KiB) Downloaded 37 times
(102.49 KiB) Downloaded 37 times
