Extracted

• • Target
    Pony.exe
  • Size 97KB
  • SHA256 8d786581e2e1a167d1f528e318619182d2fc5ec62e2064f4f9fc83bcfd2d3486
  • MD5 cf94cf67563e699dccb58f664d915140
  • SHA1 03f451afda8c7b62785771fd08750a6528728702
  • SHA512 04cfb20b1bbc3f39842860d6456346053168f1e188f59898131c991689c02f4c74bb21e9a68ade8bd20ba8a5af97d4b589b5d35b18b6d4c31327ebf9c59285dd
  • SSDEEP 1536:9iG5QUS1CqTE4SvhGBPfM8ydaaeg3iJuxrO06P3vrTvIhMkzb5+Ht/f1LFU:Y6RS1ioPfpydOgOLfYhJMN/f1LFU
  • TLSH
    T1FDA30913F8D1E0F1C1A2267667C12771E7FDAE797C7A4D4AEF8C584569F2687AB02002
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2