Extracted

• • Target

    Pony.exe

  • Size

    89KB

  • MD5

    ca381a2a93d10d033ba1251927c38775

  • SHA1

    8d6e345bdb55002779304519f026fb4b4e67d128

  • SHA256

    f508aab83a08d9a8d9f2274bc967cba51dde8c9e045bcc647df061d86a186f1b

  • SHA512

    85b6339bdbec8ac014439df73f9ef062139c8197023bdc1f703448b95f1d4dc5a01e7aba9093ef6934aa94089c5319ee3f5384e4f479b94f5004e3c5d59e6fa8

  • SSDEEP

    1536:HEAwP87MqTbX+ZlIk8q0pTs/XS+z1F+OXBbGTv8E6hkzm8Ty:kAnaA3p4wOpE69X

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2