Extracted

• • Target

    fb1bc9d61f6a55d689614629019a4fe4

  • Size

    132KB

  • MD5

    fb1bc9d61f6a55d689614629019a4fe4

  • SHA1

    51fd6f52b7987eb25b6c091f5515fee47ecd8a84

  • SHA256

    5c88a87fbd4fa93f51ac66f61ec09ce1612e4ee7fb3fc7a00d9b3551113553ea

  • SHA512

    6e8476ff2b15b8af51fef549a32e7e67c1dacbee072bc1e6519dfc4866bf74f0849042b3fa2137056dc94a5893355892ac3380fc93b13b08f6c78344492284c5

  • SSDEEP

    3072:DfbmUkNmOJBkxgqC3sxQPkA7HFEVOl5XP:jb/k7CC3Yy/HOVO//

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2