Extracted

• • Target

    53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08

  • Size

    269KB

  • MD5

    57a8e8164abfa421719eaabf5b6724d0

  • SHA1

    56bd47864f4fca9ab8005365262aa16148366cd2

  • SHA256

    53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08

  • SHA512

    b77f411cbd12b7d61453755bb831cfd785cd2cdedd520165427552f2199df410e6b92d39add6a43fee539dcae29536b42102feeebb176cd6ea3575d23131c193

  • SSDEEP

    3072:bNxxryjRaR/wQkdKq/8cPoEOMlE/3H/QDjpt7cuwBCi1BHHBFobHbEzVa8/RX4P/:bEjRV/84obRffs7UCi8zbE1+

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2