Extracted

• • Target

    c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

  • Size

    225KB

  • MD5

    57a9a1489abff9bf710a6449f627a7ec

  • SHA1

    b78147c9cb333dfc4dcab39309808dded9eaabe5

  • SHA256

    c75434ad0b5e5444e3d676ced4331241a7f6b725d4f110a43dc35699f658e42d

  • SHA512

    4fe2722b84dd47c309d8bf161e5df97d976a9bead33efad16b17abbbc388da4bd0ebbab7fee716e912b0a44604a3f74ddb9bccaf46a994fa4f5e4cc691bea2e9

  • SSDEEP

    3072:4VSKIWJOOuepNUnzLBitqnHBXo/f+QqfABAh6S1/Z7i/e5rdUtYN8FK/qjoOzjNK:aJwepKnzLnpzQAABAh6SXrvKFZjN

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2