Extracted

• • Target

    68d263399f5e9d8a448c0dd1d9b816d98e109f41a6368289868d2a4ce2e79bc0

  • Size

    376KB

  • MD5

    322688bcde3acd3f0e183a9afc9b0420

  • SHA1

    1efca68b9d7656320eabedeeb803167baa89e992

  • SHA256

    68d263399f5e9d8a448c0dd1d9b816d98e109f41a6368289868d2a4ce2e79bc0

  • SHA512

    d9e28297620119f78795ca90ea11a62638ec72db4d6b245e9b42a6a141578f6d8982fcbd80fbe3f6bef2179fa922afa4809f9a3dfe998525bad458d19c9ab4a8

  • SSDEEP

    6144:6JV0Rnw+JEVNHtnLMZ4Xa0XoeHgSISpk+Zr2+MsDFBDVB/vEnaD:6JV0qMqKly/IPKEsDbDPvj

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2