Extracted

• • Target
    Purchase Order-16905.exe
  • Size 360KB
  • SHA256 b759aa1730a87cec1d078918f05e645fa774b1df4b2551ba4aaa904acc461e01
  • MD5 1024adf4f8248593f19690de9ff0fc8f
  • SHA1 2ff56a6e3933164fb8d3beeeea972e458d7f73ed
  • SHA512 20cb3051ea8689df2b14b55cd44508037a4665d7e3b813867cfd3f90dbae831d43348ee36b9714693fbe79b8103494d472c325333d125ba5b5e593f8e54fe1ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  ponycollectionpersistenceratspywarestealersuricata

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • suricata: ET MALWARE Fareit/Pony Downloader Checkin 3

    suricata: ET MALWARE Fareit/Pony Downloader Checkin 3

    suricata

  • suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98

    suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98

    suricata

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2