General
- Target 961763f4ea946cf0a348f6a14bea638389c65c258fddf9687edb5dd6ea600000
- Size 286KB
- Sample230129-13vd2aeg58
- SHA256 961763f4ea946cf0a348f6a14bea638389c65c258fddf9687edb5dd6ea600000
Score
10/10
Malware Config
Targets
-
- Target 961763f4ea946cf0a348f6a14bea638389c65c258fddf9687edb5dd6ea600000
- Size 286KB
- SHA256 961763f4ea946cf0a348f6a14bea638389c65c258fddf9687edb5dd6ea600000
Score10/10Modifies security service
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
Disables taskbar notifications via registry modification
Executes dropped EXE
Modifies Installed Components in the registry
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Loads dropped DLL
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.