Extracted

• • Target

    801269696bf449b317d1ca6b613d235b8d9187a7ad59520c75559b76b36e6171

  • Size

    149KB

  • MD5

    3da2447df2a9b31e5cd0cb3b624209aa

  • SHA1

    051af6db1eb6c662c71ce6887afaac8552091662

  • SHA256

    801269696bf449b317d1ca6b613d235b8d9187a7ad59520c75559b76b36e6171

  • SHA512

    eca1aa2aaebe27c1b10ed12f464f9cebcf6c6dd5d6ba11a851c52ad82011e528784d41fd83ca95a2ea26eae77d986fa29ef04b596e7c1193f9482af7ac8c5da9

  • SSDEEP

    3072:QXK+CWzSRSpNVWYpgdk8cbT+2m/e2gTQoL8BSUJ65oaW/7zHYy:QVCdSpNVtpgdLmFmm21Y8YUuwc

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2