Extracted

• • Target

    93855147c6288bed1edab94ebfb2ab5af3ad2477f930b5019dc26470cf68494e

  • Size

    132KB

  • MD5

    5047fb8fd1a75f2eeafcc2492f847508

  • SHA1

    cf0ca3e3d801084f3579f89a05118c958c8e5261

  • SHA256

    93855147c6288bed1edab94ebfb2ab5af3ad2477f930b5019dc26470cf68494e

  • SHA512

    ba2fe6c4aa2cd7dd64667a6c6e844ede61b897295db414f37d18d550a832e79f8e5e1dd08de550755d1ce4a2b5552b7464ce16e65331e2a86e2cde6b4f8ca09d

  • SSDEEP

    1536:scx7hINAwh06A3Z6LIv96q7mFoEIT5mq/mDjX4z6WLpVh3eK7M+2nHEZg4avy2nG:aAqRk6LgRxtluQz6MpVtM+2nHEN39

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2