Extracted

• • Target
    Builder.exe
  • Size 32KB
  • SHA256 9ee9c06c0ac2d053cbae65167513e1ad241a6d952d7672f923bfd9b221f48538
  • MD5 85df7137538e6c3eb87976fec95d8e16
  • SHA1 d5191d2d636544b05cd2faa14ef4d60e9c4a861f
  • SHA512 55eef83e7dfeba4150566c5b410173fdb4b3b96d969f6466fd8dd2f80aec5f22510a1379e19faff4036d9910a6a46036a2c219225d775ab29461ca44d61f514e
  • SSDEEP 384:aKDr6acgvJk0ZC2VYzqsGgaCCYyUcuVFg/DlEQc/KD:VJvJtC2zC4+Vgli
  • TLSH
    T1DBE2D9338A284871FAD686B205B158F61523BC2254D1AD8B16C85E6C1D37ED3FAF472F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2