Extracted

• • Target

    afad2dcc31a1be8ee92f17b1b1826749e9087ac37511e439af1c7d76a07095b3

  • Size

    141KB

  • MD5

    f49e7e1ba9e5c36fcdbd956127e705e1

  • SHA1

    7a6faecddcc0c15ff636fc3c488457f39fc225ae

  • SHA256

    afad2dcc31a1be8ee92f17b1b1826749e9087ac37511e439af1c7d76a07095b3

  • SHA512

    be0f703ce7d40e7db3044b6d7aaf5c105937a9ac6b23e6af4106ee3c8cffcfe0d8061e4963ab10c426dcf98886db95f5070353b78d19357755e9158c869d9f71

  • SSDEEP

    3072:ZVWiwV7YXuuWiqQWWWZxAaWd0i2obBo+1jG7paJl7pnSdd36Q:zWiwVcVyQZwxARtpb7w9atnC

  Score

  10^/10

  cobaltstrikeponybackdoorcollectiondiscoveryratspywarestealertrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2