Extracted

• • Target

    1e0bf00fa749c3e62398a2ab17c87c0e9bd2f98927995a83e6ded5b8a8d77982

  • Size

    97KB

  • MD5

    cb6823b2561fe6b9b77a29eb8814283c

  • SHA1

    8fa93ee20405d0fc0ae44d5741173bbc0fdd49c5

  • SHA256

    1e0bf00fa749c3e62398a2ab17c87c0e9bd2f98927995a83e6ded5b8a8d77982

  • SHA512

    435179995c8659dd45747058b91cfdf5a4b1f6f5948df8d2b76395efb9aa7d98add0d81a63a637c2720c0d512955d122f72bc12246dd23f52f58bf01143429fc

  • SSDEEP

    1536:b0XXvVwNiX6ZC8qHlLYHroQH3M6wL0a60a2qebmwpC:YX/a0X6ZfqH1YHdM6wvjM

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2