Extracted

• • Target

    6ea4fe3a83f1f48873bb07c52f837a766d42b6d27d4db2a7dd08798a21bd2738

  • Size

    113KB

  • MD5

    7790d0c73e72404d5aefb37be44f2af9

  • SHA1

    26de358806852f608d20419c938fb1ad61ae761c

  • SHA256

    6ea4fe3a83f1f48873bb07c52f837a766d42b6d27d4db2a7dd08798a21bd2738

  • SHA512

    5055b46b21ce455006c0412201f5aaba1eb184a1a90ac0970cfbe42bedb0499d6400519f087a3f3f554610809c4a9ef596a33c535112a958974e0cd10b161315

  • SSDEEP

    3072:kTY7VKne/pGXIvDbKfn4YO6P6morL3Atm3TJ7:sgVH/NbbKfTHtm3TJ7

  Score

  10^/10

  cobaltstrikeponybackdoorcollectiondiscoveryratspywarestealertrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2