Extracted

• • Target

    1721775c6d33bf147d0eec83f5b8e92b1e8ebf3baae9dd9fd77c189fe79f2324

  • Size

    324KB

  • MD5

    7d05eebdb0afe7c4c4d5231eaa271118

  • SHA1

    ae2c8059389887f0028ae61c89fd65d878eea7b4

  • SHA256

    1721775c6d33bf147d0eec83f5b8e92b1e8ebf3baae9dd9fd77c189fe79f2324

  • SHA512

    46a250708d573966313dd28e1b3db546634c58bb886fdda667208ae9608048521bd6a8a8d529c68cd447bc419f773952b559cd555c911aea940335768d3369e6

  • SSDEEP

    6144:a4w/TEf3zR2c++Mr4sIJbWGQ4w/TEJpnss2XjXrHPWftnyBXMxoMKk:xqgvzMrrnIYSqgJZss0jX7uB6uoMb

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2