Extracted

• • Target

    15767b9e41ee631007be134b6ed1a65b9cf1805e15a730ffa18f62efb88ba7fa

  • Size

    770KB

  • MD5

    30ac5cdbdd174e3debe2967669080398

  • SHA1

    e0fcadb812d01fe5791b9a17414ea1d35c9e4e15

  • SHA256

    15767b9e41ee631007be134b6ed1a65b9cf1805e15a730ffa18f62efb88ba7fa

  • SHA512

    8bed779eebff6b0f1218f7b1fe4c9e2cf0ac8546146a3fc8545cf53c4b5568f41877e77fcc7535a4e00a677233495b1d167f176e65146dd5cf10d4aaca8ac0ed

  • SSDEEP

    12288:hdP4gs4g8zMQtBgaJm8tspGtgsKZd2fKZd2EIAB0FIzuJuXtiabre:8SVG8P6swEwFFzMudia+

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2