Extracted

• • Target
    Pony.exe
  • Size 97KB
  • SHA256 45fe795f1664043ee44fa648a267979ca6772f9d722e4ffae2b4ae78995f6109
  • MD5 2affb3f744202c661d9987185250c579
  • SHA1 6291e003328637b9fe5a5886971159489edddd6f
  • SHA512 640586b32cbc8b612614cab96d950b8cd3ff41e80bc9716e5f7a7d4b3bd2145bb2c0f1df14084c8d7585572a9883e547157c918d08b216b539b27b7212c88085
  • SSDEEP 1536:sb5wH1r1ppqTQkyWvzEZc2NKCXgts7zehz+5AuOTyZRpTvtkzb57Ht/11Dfw:ys1BpPkYK2tgt+FO6u5N/11Df
  • TLSH
    T16CA30843F8D1E0F1C1A126763BC127A1E3FD9E797C768D4AEF8C594569B2687AB12002
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2