Extracted

• • Target

    79f7d2df7cec7c1811a9b06e7bdb7662b384c3acba8cf669151206eba7e8f5ed.exe

  • Size

    638KB

  • MD5

    217ecf83d89f2f33eec443c5c732b14c

  • SHA1

    099724bf554b5e3d90b011df6e131bd3ed1fd8bf

  • SHA256

    79f7d2df7cec7c1811a9b06e7bdb7662b384c3acba8cf669151206eba7e8f5ed

  • SHA512

    c7f76e18698a4722ec2b817e684730e4106ad945f1ef0ee84e0a50166a9867e859e1a5ee0070b054e746bec470b2a3dffb5713776fab89beb532459d403cfd85

  • SSDEEP

    12288:bJ2MJ7ca5lRUEdHry/6dVuwzgz92CpQD4m:/lOAmQsrsC2P

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2