Extracted

• • Target
    89c6b68a3f89ba654147a93836cb517f2e1a78da2ac27b2a7de637a3748ccc1f
  • Size 288KB
  • SHA256 89c6b68a3f89ba654147a93836cb517f2e1a78da2ac27b2a7de637a3748ccc1f
  • MD5 a6fb25e513463283b71d0a9bae3c166c
  • SHA1 480889cb4eac83a9b9c95feea08a27b6f2767016
  • SHA512 b1434a89a96e5a8120751518e057435e65502f9a0517424f4197af4207b14f38cfcd86ec6b032db40f1800c36336b92762f96984899a75774408044b4cf45851
  • SSDEEP 3072:EUc8VlLizVc2aAes7GVGNVGWPo/0BSgL+jGBce:EUc8eBh0ioMBS8+q
  • TLSH
    T115542D9C28FAE584E7E748F5C9F1AEB0C04578916AF19902EC45F37E912317CD5E20BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponypersistenceprivilege_escalationratspywarestealerupx

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    89c6b68a3f89ba654147a93836cb517f2e1a78da2ac27b2a7de637a3748ccc1f-cleaned
  • Size 276KB
  • SHA256 f24bbb2c28e3a3ab2329ce13fadde65c9596396b02b1c21c6d6ae4cebc6f38bd
  • MD5 689bed9c92084eac9912ea31000c57aa
  • SHA1 131e317b460d825a6052ec2f5d1a9e43eca5a37c
  • SHA512 3c8586a7f3bec4361e6b8900f3b16f65e868c9b7aeab52cbcbbb4baf163bd65eb5af52f7709439fcc653448c035132aa8a445f0db2a03dfb0e429c25264230e1
  • SSDEEP 3072:MUc8VlLizVc+Aes7GVGNVGWPo/0BSgB+jGBce:MUc8eB20ioMBSy+q
  • TLSH
    T162542D9C28FAE584E7E74CF5C8F1AEA0C04578916AF19902EC45F77E912317CD5E20BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponypersistenceprivilege_escalationratspywarestealerupx

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3behavioral4