Extracted

• • Target
    2026-10-26_5493813d11669acc58a1c1d0319eccc4_agent-tesla_darkgate_elex_hawkeye_maze_remcos_xloader
  • Size 1.1MB
  • SHA256 508836df3c0930d5d1851b3628e903867cb566cb123b3fd8749b8104f4ad931f
  • MD5 5493813d11669acc58a1c1d0319eccc4
  • SHA1 09efd7e46842be9de97b7d1bbb217bbb0b2ece64
  • SHA512 90d6a5ade73c60f863010eb80832c03d5e7d67e446be368ca466ae1ef1b6ffbcccbae37afbeefcb7110a98ed6c5630fee1bd4da9b7fa9d4dccae06debd239687
  • SSDEEP 24576:iu6J33O0c+JY5UZ+XC0kGsoTGcjr1I1lOq6sb8hTH7NWYC:Eu0c++OCvkGsEGcjr1i6skHUYC
  • TLSH
    T1BA459D12739F8260FE6E61327E596301EE6ABC212520FC772EA41D7969231611F3C76F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2