Extracted

• • Target

    5364f6462a6075967177bf5e1638daf8fe7853b70b044b0913084eb39a528891

  • Size

    34KB

  • MD5

    123a23e9a5360664e57d31cddbe541a8

  • SHA1

    b1487721ced1789ca7dff4d4a2f59c6269f59d0d

  • SHA256

    5364f6462a6075967177bf5e1638daf8fe7853b70b044b0913084eb39a528891

  • SHA512

    7b91e9288beeef644dd6509c0bfbc7380f496736a165515452207172ef5f3359df78a3f1adcd084c4b70ba22663a6b392b5a66582427730adb4c0d78d534ee04

  • SSDEEP

    768:RqjS8DXzq939829fqywA7gujWBQ51l5Kpy2:RIDXWBqyd8gLKp

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2