Extracted

• • Target

    7845856e3f8f726a7fae095742bb14f9

  • Size

    153KB

  • MD5

    7845856e3f8f726a7fae095742bb14f9

  • SHA1

    1ddddc0f904c6f366cc48731a4dc4d5f6092a89d

  • SHA256

    5c1de7ab2e58cbbb1656fae3de8dc384930af80c2cfcc7e662c40f7416cd2fe2

  • SHA512

    8a85b166e34621a2bca48728e6aaf7c23eea6312682f4e5321154689c3563032a4bf8196ea658f22a27c934c582368c78d022fab73b09ef0e8a4bc75e34e3cfc

  • SSDEEP

    3072:d2jpmyvLmkNlzOAwa+PbeoB9yzu1oDtblbH/VoxKrUilzM9QR4J:Y5DD+P58u1oDHbfVox8qM

  Score

  10^/10

  ponyratspywarestealercollectiondiscovery

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2