Extracted

• • Target

    cb301ec4d57f6bda7280a533b83096f6

  • Size

    81KB

  • MD5

    cb301ec4d57f6bda7280a533b83096f6

  • SHA1

    c1ba092c1ff103b91696875a11127046ca0bb531

  • SHA256

    3b6f11d77bad59a8761199d3fad09a1c3c0c8aa80c5751dadf7ca8f39f7c2353

  • SHA512

    c86ba05fb36ffd25ce7221a2aaa8a3993dcccddabfbd76b6d03c7fa51439fc5e466fb0376fcb1334fd8c25385b9b5395dc286f8f361c6f5afa587500bb726817

  • SSDEEP

    1536:E7I44meDR3VAwilSc6bm+8+k0FRpZ5V2ektoLrPYzj18P+:QL4meDR3m/lS1CKRpZfkt+rAF82

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2