Extracted

• • Target
    748320cadf8f869f800f6968f437ad10.exe
  • Size 438KB
  • SHA256 351cb29f79ab4ce5a30bbc76d6a49135d1e6c9704884cb1f11a9b8a7fc5207e9
  • MD5 748320cadf8f869f800f6968f437ad10
  • SHA1 4f5b597c61b6590ce19a3ecaa3c5e453d9493f40
  • SHA512 d204064789d11221b1a3b8c392f8649828550a899d21835671940a218c0eb92977b2ed640f5b23f8de866aa204396e5c3405f7573e52461bdb4dc0514c11dc39
  • SSDEEP 6144:2ltrqAMqqjWybbQaw4nLyCkAEUL8xzG8bc3V/h6QOLZRqCyK32AO/Xo76INH:Ed1q6ybbQaw4Tur23hhnyRqCyg2d/4L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  upxponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2