Extracted

• • Target

    d1c3b77a09af9f1251cfd4137686bb49eda6483fbe6473786bfd743397b6b9e3

  • Size

    80KB

  • MD5

    3518a1d080e757623b8c932a46fe5e96

  • SHA1

    d52ef4efedc38bb196fda28785626a6709d1e17e

  • SHA256

    d1c3b77a09af9f1251cfd4137686bb49eda6483fbe6473786bfd743397b6b9e3

  • SHA512

    da3add210b0027f216a4ea028caccade013ecfd0f7de0e2e73ced639cd9c3a42da5bef8044ca5466c5d5f11dbed9256e335d41bdc9fc199370d789b5adb829a4

  • SSDEEP

    1536:Y+XxWZNJJgngogfbQThy9OIKctZ/3Brl+rLqnouy8SBpL:Y8YNJungogfbihgZFNxkrLyoutI

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2