Extracted

• • Target

    850ef15a07452f078b6bc59044dc0c26c3520eea4debe9f56acf46e522578f45N

  • Size

    133KB

  • MD5

    a6e87008383058a82f614987180464a0

  • SHA1

    d61c8daadb88a6bbaacac450b62e633ee8f74fe3

  • SHA256

    850ef15a07452f078b6bc59044dc0c26c3520eea4debe9f56acf46e522578f45

  • SHA512

    dae4c7eb739378e4e63f5365a0bc7c45d3643dbd125a8ccfce85a15b546c0abe50388eba3db488501a4ac480d137d5f3c7e4f69900b53b63201e521cc8b3d019

  • SSDEEP

    3072:XnQJPhkFz8rIpNLoBJxH1GInCsHCT73xy4KOOX4JR:YrrIDLo3J1GGCsHCT733KOu4J

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2