Extracted

• • Target
    df4a522c8889c08eee3a1e6d77f38cdacaafb8e7f20559a527c027cd90e8ff80
  • Size 228KB
  • SHA256 df4a522c8889c08eee3a1e6d77f38cdacaafb8e7f20559a527c027cd90e8ff80
  • MD5 cd6a393be3c0c75ff70df21c546e36f0
  • SHA1 481fd92001013b3985786546bbc4380033215da8
  • SHA512 7e3bed157e975ed982d65a82d8fa0ff376b52bd4b000864b88647c4511c2eb66e070791b6b1edda47a164dd252d24b29e273314234c0aff738fb3078498fdc4f
  • SSDEEP 6144:ecDdviEoF4S0dFhE6UB5fYKvDAhSClIlYz3sieMT7wo:e89i4S/6UBLAQCClYz3sieMTs
  • TLSH
    T1FF34D082B9C085E5EDA6073448364C66432BFCBADB38125D73C2B5795BB6293047DF2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1