Extracted

• • Target

    42b8503d47b564a1366a12b67db662d27f209e6c785eb234e8788cdf65b55726

  • Size

    513KB

  • MD5

    8a74c1af5c133e0b74afd23d1d16558c

  • SHA1

    ae685b826bd5f7c231f8d9ee7c94c48eac7fe30b

  • SHA256

    42b8503d47b564a1366a12b67db662d27f209e6c785eb234e8788cdf65b55726

  • SHA512

    2a94764784193586444dbd16fb7b8c81f8418d002538c0fb87080abd10188131ba6eff4798846f4b58172a9ce9f0c527dd6bb6fbaa445825e1e4708c0616917f

  • SSDEEP

    6144:WTfFDbRnOTrA24QS575Xvk6VBiHQLO8IUeErP+k9IMXgXNZ4iIFgRpctuD1MTRAr:U5O74T7RvkQit8jrgBZrMwyTRAZG4av6

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2