Extracted

• • Target

    16a61feacc850b00ce26f6e670e0cdfadb105a549e1afb2e5ec02daa7cb78629

  • Size

    75KB

  • MD5

    baa2d351a0908b122970a9605b362bbf

  • SHA1

    9f53c3f17ad182bd5316ce8302c78807d3769f63

  • SHA256

    16a61feacc850b00ce26f6e670e0cdfadb105a549e1afb2e5ec02daa7cb78629

  • SHA512

    78008726ae92b9e15de73b808ecc62a2be029afa9c7fb86bfe0455a80bae483c9dc0b2beba78793ad52d752f25e13ace39c522abb3b19f438a2db50a1e3ca0de

  • SSDEEP

    1536:WUAsNyoqsXum5fJ50UOMxyWS/aCREpQ6JwPNZLQnouy81eF07koF44Q44TFitaLZ:0sNyoPXukqpMwANJwlZLYout344Q44TX

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2