Extracted

• • Target

    a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

  • Size

    128KB

  • MD5

    cd8b637465c0a482d0cd6e15ba5fb147

  • SHA1

    d2075a7587268721e06aadd40a36562203b4d1d9

  • SHA256

    a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

  • SHA512

    0dddf67a04c16fba798bfd90e047e48c3f8a833e14a46cebc0edf50905ac5d7496713e3066b3ae9b73398f02f3f3adfa31a65894780f08caee9f4a96c6a0ac78

  • SSDEEP

    3072:uGHi6mwSpIZsgDQqUsDWveXhMbIiDL6jjrZsJI:+1pPgDQqUGwfIYqjr

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2