Extracted

• • Target
    ada1c236e493c123abf181b123724bebe8655860f7b8bc0063162c14418461f4
  • Size 132KB
  • SHA256 ada1c236e493c123abf181b123724bebe8655860f7b8bc0063162c14418461f4
  • MD5 0890a0145ef72d533498c3159af1f450
  • SHA1 78e7b0b8d27ffa6f3d6933b22d6459991d3a6ecf
  • SHA512 049581377ce90a5b6409d267eebe76b0b89633c1eca67bd68e7490899b6e9ad91763226cc8702620511f650105749cc785eda36678f0df90e153e7aefc8b3c5e
  • SSDEEP 1536:2L/FMEu7mbD70WOpvlG/XR6PFJ4XgpvJL8Bc2U8wsxfOtb0hqfaTfjMkfeynskrO:e/UrvlYB6PEXgpvGujuwaTfpxskmLEw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2