Extracted

• • Target
    3fa7cbc9620993cffb3d457494fe92d1f60f2d46696c64c765abd53108083ebf
  • Size 101KB
  • SHA256 3fa7cbc9620993cffb3d457494fe92d1f60f2d46696c64c765abd53108083ebf
  • MD5 42bdcf2596c46591cac9ca2876a1f2a0
  • SHA1 ee6081de159b1547c91a7e0620c72c9e8623234f
  • SHA512 273103908aa8d02c97fb527833271496f068fadb3d4cf06c16b414c79e260790cf2a79bed0f3399e739ccd2f73504db79844df457dadd51bb8fdbe86410e961d
  • SSDEEP 3072:DCSYsBqnlkyKpD1D7SnyIhDcwVqgLIIw2MWKV:DxYOqnyyoGnthDcwVqOIIw2lK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2