Extracted

• • Target

    be0b60d04f91f29a8c5b7e4e06de84278bf745dcd4249057ee9ed7fcb0ea22ea

  • Size

    212KB

  • MD5

    3af75011bef7e95e9bbac8402e35f542

  • SHA1

    95ced7a1be1a5b876bbb36e59ad22350da3ffb50

  • SHA256

    be0b60d04f91f29a8c5b7e4e06de84278bf745dcd4249057ee9ed7fcb0ea22ea

  • SHA512

    09d55e40769a088745c832e40a0fde40097fe6b49acf1166a7092c5408a249925cc9ccf4cd3c8d4da97729d0032810d490ba5408947b69028774cc64fae58535

  • SSDEEP

    3072:zv4NycnpTryuQrMcPHNUrHvhyH8sVV85dohxfT3zpPsh0IGSamERxbe:hop/ybrrFVV8glT3Vshj1oxb

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2