Extracted

• • Target
    2026-10-21_92595824f1242cf8a94e6f954d9d5e2c_agent-tesla_darkgate_elex_hawkeye_maze_remcos_xloader
  • Size 1.1MB
  • SHA256 cf05126efe1bcb4a3fdd21161a0565a9526d157c0d6d6f03f9d49836c2334ee2
  • MD5 92595824f1242cf8a94e6f954d9d5e2c
  • SHA1 e704f66267b06f7d452887cc3e4676378b629eb4
  • SHA512 d3f41865beef86ae8fecce25cbd38b2fb76abaa0cb1cf4455e7085470a743e370a06766749a6f98da151828d66adb3b847462624ead76b4019bf5dc492c960b3
  • SSDEEP 24576:iu6J33O0c+JY5UZ+XC0kGsoTGcjr1I1lOq6sb8hTH7NWYK:Eu0c++OCvkGsEGcjr1i6skHUYK
  • TLSH
    T150459D12739F8260FE6E61327E596301EE6ABC212520FC772EA41D7969231611F3C76F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Custom signature

    Detects executables referencing many file transfer clients. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2