Extracted

• • Target

    910ce1937d08c0a800d222148982a3eb5c6ec1d7a8d190ca31fcf010f7b61c5e

  • Size

    144KB

  • MD5

    b84aaaa9bd1114a8f39c6847b16cf63d

  • SHA1

    3aa58f57cbd3868eb1e5a3de9366b279f540088a

  • SHA256

    910ce1937d08c0a800d222148982a3eb5c6ec1d7a8d190ca31fcf010f7b61c5e

  • SHA512

    5d68db1e0a35089e9067ac292886979d95ec34aea75d6436a0b02e1ff62b5d0c828694277654f74dd236735c8aee6ff15f98817afe85bc02cced8a12c6d1518e

  • SSDEEP

    3072:oDZaZeFbL2PDVlZ2ilhdh+ukIRObZzFpdXpaJxqvHUgrQ:wgeYDVL2irv+UYbHZazqMwQ

  Score

  10^/10

  cobaltstrikeponybackdoorcollectiondiscoveryratspywarestealertrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2