Extracted

• • Target
    ab5d9d0f704df9499349451ca2abb2a4.exe
  • Size 109KB
  • SHA256 7280515cad1a462f3c0fb3bf494f566d1a3a9c70bab2bf633c81ee88f3db07c5
  • MD5 ab5d9d0f704df9499349451ca2abb2a4
  • SHA1 4b23d67fb546d71df2ccfb1d710cc91785a568f1
  • SHA512 a242fbd9e5480476812b851bafda02f9a94715bcfada075fa9f397d316a75cacab44b3d84826aa8740a4bafad77f563eb869cb8c74d89a96b18ae81baedcf60f
  • SSDEEP 3072:Drc3BDUde8aPMo02jBcQQLO5aDpmYDEIc9:fcRD3PjcQi5pXYJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2