Extracted

• • Target

    1a65c42dcc0f217a5d4b06b7655d3958db5e33abf4fc6bfdbf88a1fdfcc4eeb2

  • Size

    222KB

  • MD5

    202fe901eec6ef893f5f8d86528e5d54

  • SHA1

    1ded84a8c931c682d21fbc3c5802eff21e336f0e

  • SHA256

    1a65c42dcc0f217a5d4b06b7655d3958db5e33abf4fc6bfdbf88a1fdfcc4eeb2

  • SHA512

    13f64d4af37a5f19526384113a587c690fea24fb05307c15a81125ff5b34c05b08eb27b88f67fcde470c3ebfa172f95f817f5c73252744bc81932496380c88b1

  • SSDEEP

    3072:zVIfFuR6AqFMa2fL3NtkWL90y7K4mlQCww7zDTW6HNRn0nPmaw:zVIf8RsOtZclptz78Pk

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupxdefense_evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2