Extracted

• • Target
    AFDF78E26E10793941CEEEC156433348F6B050D79F86E.exe
  • Size 232KB
  • SHA256 afdf78e26e10793941ceeec156433348f6b050d79f86e46b88f5755bc9c3d148
  • MD5 aafff539597334410c592b28f4a521c7
  • SHA1 a887c69811cf126e17a3f4cf0c241daa65365be6
  • SHA512 57246708adf6143b7be50a770eb8ed2b4b799591982be32c14d9f75ea7edd2eac4efd257ab169717e825313bf4bb925806b78df971ce6d2ca3461aea75f3e904
  • SSDEEP 6144:WSZrtUbaNpKEHcqoh5Iwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww2VD3L:8eKE2h5RhTp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2