Extracted

• • Target
    378ca5a3eebb4f6233a34fd12ff40ee0555df5338a29a39227033a09fbf3a579
  • Size 98KB
  • SHA256 378ca5a3eebb4f6233a34fd12ff40ee0555df5338a29a39227033a09fbf3a579
  • MD5 0961dac1b75c9ab1fb79060ba65f7610
  • SHA1 06147af2ddc4c45c16f6fab64c58ae928da17f7c
  • SHA512 a953c61c726212fcbfc9e4003de07e9d8f839b7f0739a2d57f133b250d5d058687918e3428b9f548932e8affbab0e021d61e3d182ee9466e3a189995156960a7
  • SSDEEP 3072:IVos+4nbzUNteHK0R/YZiv5dDGW2jl/Yn:tqzewKGYw9G/Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2