Extracted

• • Target
    03232fdd36bbfe7006b2046c24b8a0d69f6fd7d50699a0e037330b56d7ae2153
  • Size 79KB
  • SHA256 03232fdd36bbfe7006b2046c24b8a0d69f6fd7d50699a0e037330b56d7ae2153
  • MD5 c3d8e15e58f452b2b2504c17de06533b
  • SHA1 483138a1f047fc20838d33456f9bfb039ed7ad34
  • SHA512 2110704adf4992db6911715554fc2e205e11959c2eebbca54f95d95ce8b9b0f6146124150125dce3bc35201328e573fd3ce47a3c20e840bfa1aa12c0c89ab0af
  • SSDEEP 1536:kccxM1YJoUBl7Txf4Y/swb9wag2i/hwMK2k1fVqyr0ikU:k5aOTxfSwRwn/VK2qwyrUU
  • TLSH
    T1D983F1B117D2C2C1F4174E7809AEA7A5FA74DF3AE138EEB625A034F42570600C5B5F5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionponypersistenceratspywarestealerupx

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1