Extracted

• • Target
    cceb2019c4d2c01a6856c63d162c53eb55738b24b0160d3e2a6b897ac961df66
  • Size 1.1MB
  • SHA256 cceb2019c4d2c01a6856c63d162c53eb55738b24b0160d3e2a6b897ac961df66
  • MD5 0af2854b620c594d365dd93a5ae36daa
  • SHA1 7df40d84446a420909913e4b6d533cfc0e09615a
  • SHA512 80dcc8ec258754b81fdf2e6e24b4213d1517b966e5798bf6c6a4dae7ae104721fddb585a70e0bec778c215ae36068be1772e3e5991debbec307f12e836516219
  • SSDEEP 24576:iu6J33O0c+JY5UZ+XC0kGsoTGcjr1I1lOq6sb8hTH7NWYi:Eu0c++OCvkGsEGcjr1i6skHUYi
  • TLSH
    T164459D12739F8260FE6E61327E596301EE6ABC212520FC772EA41D7969231611F3C76F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1