Extracted

• • Target

    f9afff41ed863c356c43cc6d8f3fd13ff6fec4fc5bcb6ad3e3822ac13a8fda2a

  • Size

    97KB

  • MD5

    96f83a6611d7732c44966946554f9280

  • SHA1

    f1da1341783bd60c3d30b78528e63b642d42d9dd

  • SHA256

    f9afff41ed863c356c43cc6d8f3fd13ff6fec4fc5bcb6ad3e3822ac13a8fda2a

  • SHA512

    447be25e5112ab1122e329a8a5ae6332b0a58865ef72988d121114b21ecc199cfc92ad17b8097e9b4484f452862584e2f4fb63a6d836ab6c5beb1f2d09d632b1

  • SSDEEP

    3072:1OIkQqfJOXR4G5HlRZ0RIioWOzhK+SGAnX1s36v47NK:1xkXfJORp5PmmvRtKt/luh

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2