Extracted

• • Target

    31f635559e79406a3abc023f9c29cc2c04a03bd75b866c5f6500ab09c29e6718

  • Size

    226KB

  • MD5

    4505bb59758f0fa632e1b1d6e25c5450

  • SHA1

    2d55b6afc4b2495d014aca850bac334e6b363816

  • SHA256

    31f635559e79406a3abc023f9c29cc2c04a03bd75b866c5f6500ab09c29e6718

  • SHA512

    50ce9806c2fdc171dcf411a9564c3e08935f6a4c3e6729dfbca8327616bb8bfbeac9d6c0c9babe32f4de4876a0de089e9bacf05222be58149c1c6e517f4e510d

  • SSDEEP

    1536:zP7q7CW2p0cUi/PlDxbmpfhjekGbtK01mPHD6JURJM:zPwimfwHtKTHD6uLM

  Score

  10^/10

  ponydiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2