Extracted

• • Target
    F51D69C196B61F96B9C0B857B318D47D.exe
  • Size 104KB
  • SHA256 6a46894366dca550d9e1595d8b87db420d8a96c7b542b35103f8453289d448da
  • MD5 f51d69c196b61f96b9c0b857b318d47d
  • SHA1 5b1fbc4eb4430e320d56984a0d315dc2eadef5c2
  • SHA512 67737df9161b9cf14ab01dd24f867494fd74821f65e00ceeec4fd51993f0ff8f305c58edfd63d74a6506fb162c0b4473a0998c87aab22f0e3f8e792ea044e3f1
  • SSDEEP 1536:+m5I/q/5+CyqT3AD/DulW3LWBf+uUNjqaLeO1x9uRYuITv9gEFs7kzb5vRs/nt:DICB+C/lW3LWBfAeOB8XcgEvh6/nt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectiondiscoverypersistenceratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2