Extracted

• • Target

    69e482279da56ae83bd876f04b0395ec

  • Size

    124KB

  • MD5

    69e482279da56ae83bd876f04b0395ec

  • SHA1

    16ec0c4d207c941f796423cdc64c54af3a5dd110

  • SHA256

    7ea0f8ae396036ce6a2b740bfd07c57ff94b51bd32389860c35a39af4c461854

  • SHA512

    bc8a1980a48fc272e587123c68b0d7a0cb7c7b654b45d1d914a5751fda28f53dd968ae6c6c1c972c6e5191193aba6b916d3b4fd2ba9722bb0f90c2b94b14e3e6

  • SSDEEP

    1536:kkR1gLaC2iLUmZDFveTCfRVdDe90DjM0wjeve8xtwcsZjWi0R5CCAF3XnHh:jR1z2bF8Irq0o0w6ocUj05vAD

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2