Extracted

• • Target
    2947b420476dc98c801ae0d44d8c4c7b.exe
  • Size 1.1MB
  • SHA256 0a08fac14446bf31e600eb8b30a4bb95d87577bb4584c3faae1d87919cfa38da
  • MD5 2947b420476dc98c801ae0d44d8c4c7b
  • SHA1 a736e471a1ced7a1f52a23f4808a28b8bf8d925d
  • SHA512 93e28253630865ff2aa50e080d1e646eb89fb50c7de28cc1ecd3c4e20a93a46908f03cdd63040d552de1f8bbb6015cfe0060db4841f7bf8b78158802348b95e1
  • SSDEEP 12288:EnNMd4pu5Uyh/C9ijhMrMlDfAPpy9YuOav7RpEq1FcAwFH0MROI:ENtwqCCAukDfz9PdRpEqa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2