Extracted

• • Target

    d466209a4cce9d51201dd1605e74c5a33c6691002916480858477a7e4ed8afd5

  • Size

    79KB

  • MD5

    9b4b0702dedf1fc055d5e6833657c6c9

  • SHA1

    c92e722fd532aa5e67d1e5a2be27d3861efbc282

  • SHA256

    d466209a4cce9d51201dd1605e74c5a33c6691002916480858477a7e4ed8afd5

  • SHA512

    5f04b9d84bd8aa722bd654e2650652f4b19873ddd8518cba94e8d6e0c2ff7df66f5f996eebb5d0df8afe19f4cf45bda08a6f3b9390a0c37a49f187cbba92f94e

  • SSDEEP

    1536:Pfyn9b9lTxiW6+SsNWmDBE6G72YHG3C8U1/HYYdH+Y:PfC9lNE+SUpOEyGS8gN9

  Score

  10^/10

  ponycollectionpersistenceratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2