Extracted

• • Target
    41810FD3481F8D4CCFB45FDDC97FEF5CCDFF10AF555A2.exe
  • Size 227KB
  • SHA256 41810fd3481f8d4ccfb45fddc97fef5ccdff10af555a2c1fa239c541d3fd16a3
  • MD5 ea40d77d365053cb11d1ad5e89b9937d
  • SHA1 94ce4a149f7e703abb15018178a062dd3c454b04
  • SHA512 b6e14464c7915f2b97bae0102176338c98f3a277bd0776d345d7381c70fb07dff9bb1bc234e3bf3804e96efaf2aee6f3d75facca623773dffb7825eaf83bb703
  • MD5 SHA1 SHA512

  Score

  10^/10

  ponydiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2