Extracted

• • Target

    124547f83ab768fc035b89169464a6ef4980d942c56091edc33a88e80ccf2dc0

  • Size

    365KB

  • MD5

    6bc1c351a6b80eb78be2bf037e40633c

  • SHA1

    e29069047eff77c15989c9e4bc7b84178e02cc33

  • SHA256

    124547f83ab768fc035b89169464a6ef4980d942c56091edc33a88e80ccf2dc0

  • SHA512

    79ce66487797871ec808ab8889cd37f514f7546c8a38fedc614918f507930c88c3c2ff7ec028040976ee4abb0569e4d99eb9fb39f24d30ba47e3684aad2bd2a2

  • SSDEEP

    6144:+0DfPmsNU0VauEuE9TmY8LAdu4Nu0dlZiJxnWcD/8KNSe6aKtE+2:b7PmFwauEuAmY8AtmxWcoKNSVaK12

  Score

  10^/10

  ponycollectioncredential_accessdiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2