Extracted

• • Target

    a2ea6e4e09ee6e11611c02511553aff4

  • Size

    178KB

  • MD5

    a2ea6e4e09ee6e11611c02511553aff4

  • SHA1

    13be966fedc0d56d32d4d5e37964121969ea2c9b

  • SHA256

    aa81b851bdc6b697895c44f2bb2d7667db55efe95699adbf20f31a272753ca57

  • SHA512

    7881bc2ca32f26200b847589b870b1b49f1b0b66e121792e67ba631d2729349f2b1c9eee75a2d4caaacf2d3307bedab934cebfd717d447fbe5b27855816a9ee2

  • SSDEEP

    3072:gs3/nGv6XSIk/44xD5aoMaTnR5UAsri+UP:PvnGv6XSIk/4C5aVaU8+s

  Score

  10^/10

  ponydiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1