Extracted

• • Target

    c6166d672bb2cd2ddddfd5c0126db6ae6956cd4544ab74636465e0255bde3c33.exe

  • Size

    76KB

  • MD5

    b2681fe76e17242ae0052c3929ac93ab

  • SHA1

    d440ff4f5fbe5125ad1677d4251e79e1b1aa62c0

  • SHA256

    c6166d672bb2cd2ddddfd5c0126db6ae6956cd4544ab74636465e0255bde3c33

  • SHA512

    8279a8a1752c85a351e09ed7837c43ec9902ea439430a95a81952a3043aa83412a2ed046ec97c14520ad54aff202c8a23ec9e00f2f3ef69a2bc37ae7d045c0fa

  • SSDEEP

    1536:icOEtcILha8TjW4/1LpyF22C7CSxOtGC9ek8H:vOwcILM8TqALAcRCSg4OjE

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2