Extracted

• • Target

    d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046

  • Size

    160KB

  • MD5

    50372b8bc598758fd5d85102172a3735

  • SHA1

    3be32de76798e152dd199984c6941055f544f411

  • SHA256

    d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046

  • SHA512

    e825b2d28940bc5a0a95b8ea9c4a0c12a8611fd014199ccf31d74c35b66f185160a313e7c1f3707afaeaaadc87efde3922b101365a353b14a73af1f850f96bec

  • SSDEEP

    3072:jik8/Lfyzvm6Rf6Omn/0sX096MGUlR4WjK:G/LqzBwzcsXXMDBu

  Score

  10^/10

  ponycollectioncredential_accessdiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2