Extracted

• • Target
    B4DF12AFE9FD5CC5DAF567C7C8FCDE4345E4E3C027D6A.exe
  • Size 404KB
  • SHA256 b4df12afe9fd5cc5daf567c7c8fcde4345e4e3c027d6af9f2bf701c67cb6889e
  • MD5 73dcdb2a0e613f07e3eeb555d930c414
  • SHA1 a11542ae7199c3952d1a1bbeae608ab91a5c138b
  • SHA512 aefa5590dc8115d3679bbce246e6fbb8affd9a0a91d622f9b858d7cf0994453e7b2a123720eb7373c5d1e9feff081c4c7268f5e9ab33975321228731e0641120
  • MD5 SHA1 SHA512

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2