Extracted

• • Target

    df31d98c07ecf5b27c6548ce65bbbe8e469aab4fbac2dab93b9d88a9ae590626

  • Size

    146KB

  • MD5

    9b8386f89d48c45a03c7f95de88d5d38

  • SHA1

    d022fec00de63f1493b4e84ede2db0dd159ca111

  • SHA256

    df31d98c07ecf5b27c6548ce65bbbe8e469aab4fbac2dab93b9d88a9ae590626

  • SHA512

    914fe55e40b8e9ad2e49552eb8c5cb26e28f6ad6ec912245069b3e7d33119fcd9e6049766091932efe23aa699c45323698712839326cc81e6589f437ef2e55c7

  • SSDEEP

    3072:xDDyMnV56JDwz0ZL+/bjgUzLwZ0bCf8lR3paJ1P6L0ktuc:ByWYwzaLOo4Y0bfha/CL08uc

  Score

  10^/10

  cobaltstrikeponybackdoorratspywarestealertrojancollectiondiscovery

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2