Extracted

• • Target

    aa6ee82da6d19999c35af63743fa1e07240d60a99c3df57f4e2401d64206f3e7

  • Size

    99KB

  • MD5

    3e76a912954454994b1010882828e097

  • SHA1

    0e9cff012586f91c836955008d1aa03e31a8be47

  • SHA256

    aa6ee82da6d19999c35af63743fa1e07240d60a99c3df57f4e2401d64206f3e7

  • SHA512

    8debcdb97870548d7bbd67e4e024ba63d1ca645bf8d3a6535d1d1e9560009fff0563b7b7f3ba481f5c4e193b12b833698d34b5995ed79f9c210056f991225cb8

  • SSDEEP

    1536:3VE6hjFlk/5pY3IiaiFpsThDrDeqQRobeu34Kmvgj4iyIDjuAJFa/K3lpgnlhyT2:Fl3qEqi/sFDrdQRz27XDju+FZgbyTpB

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2