Extracted

• • Target

    c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014cN.exe

  • Size

    454KB

  • MD5

    38a8e720f2ef543c92d4a619e7742e10

  • SHA1

    0dbe2b7b60cb9539edc22e115b0ce51c0037ac71

  • SHA256

    c136e30290fea5bf6e8c5a883130c543f52c266298e091fbfef9b800efdd014c

  • SHA512

    b6e88870f530f8a54139a688b77a786b978a180a521fbcf080109b8e47eb9662e93f967539304a479677e7826826679c02573f792aec82a7aad46389fafaf644

  • SSDEEP

    6144:AXa8y9dGZueisfbReyl448dNWNXEmhuAikQJ3Q7lzuKWBzc9ewaQAuf6ba7M:maV9LpYbllJ8H+EmhuqdpWFSewaQxSb

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2