Extracted

• • Target

    08ccf77b28c072b99a744f5be8788f8df3513f2c770a0c0b5c9decf998a8bc8fN.exe

  • Size

    115KB

  • MD5

    4e851d38e9aed0c10167ad978a2fdcf0

  • SHA1

    38ae48dd4ccbd353fee987378d2ad29b73bb5aa7

  • SHA256

    08ccf77b28c072b99a744f5be8788f8df3513f2c770a0c0b5c9decf998a8bc8f

  • SHA512

    e82340eb5cf0edaf7825f864540b0571bf0338eda0f94f5d26587037141d68d0e5b3819cb3ea6b2cbf594c58d8a22cff3040578bd8a796878dde088efcaddc97

  • SSDEEP

    3072:6lkbfpPyJTIqeetdxujLXGObk3MKhcWFsed4HylSPR9:t14dJofXGOb+/tqysR

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2