Extracted

• • Target
    BT00997.exe
  • Size 623KB
  • SHA256 35ddea4639e827c320273a703d111d2126643b7986e5191bb4fc98e790c939d7
  • MD5 3e402cccc483b92ae4f983453e7150f7
  • SHA1 4f1daddbe5c665f926618e93774551e6c3c3d0bf
  • SHA512 9effac3e2267c00c2618f156f5bdc0db7dbb419f04c02c67c5fe43106497a8d5dee6eac0cc4f953fcf32077f38a5d7cf984fed634306263d486d183ef34a29f7
  • SSDEEP 6144:vH0JwxwUgPAFHHvbnGtI8C3n38XrWlNUpkAyrr5VyBXW4hcFZAsmqhHIRgprxs5o:vH0i0PAHcXwxHr7ypW4eSs1k2s5YqK7
  • TLSH
    T1B7D4B32815A85912C175D67E6BC1E903F9808CD2360C9D9F56C67F9ACA33673F08BD2E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryponyratspywarestealercollectioncredential_access

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2