Unpacked Pony

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Trojan, Spyware

c71c3662a7ebba5fdd0d804fe9ff864789fa08e8286352c21b339b9db2c3db81 (SHA256)

p.exe

Windows Exe (x86-32)

Created at 2018-09-11 15:34:00

Severity	Category	Operation	Classification
5/5	YARA	YARA match	Spyware
Rule "pony" from ruleset "Malware" has matched for "C:\Users\Nd9E1FYi\Desktop\p.exe" ... VTI Actions Go to YARA match
Rule "pony_stealer" from ruleset "Malware" has matched for "C:\Users\Nd9E1FYi\Desktop\p.exe" ... VTI Actions Go to YARA match
Rule "pony" from ruleset "Malware" has matched for "\Users\Nd9E1FYi\Desktop\p.exe" ... VTI Actions Go to YARA match
Rule "pony_stealer" from ruleset "Malware" has matched for "\Users\Nd9E1FYi\Desktop\p.exe" ... VTI Actions Go to YARA match
4/5	Information Stealing	Reads application data	Spyware
Possibly trying to readout Filezilla credentials. ... VTI Actions Go to function call
4/5	User	Brute-forces user account	Spyware
Possibly trying to brute-force the "Guest" account. ... VTI Actions Go to function call
4/5	File System	Known malicious file	Trojan
File "C:\Users\Nd9E1FYi\Desktop\p.exe" is a known malicious file. ... VTI Actions Go to file details
3/5	Browser	Reads data related to saved browser credentials	-
Reads saved credentials for "Google Chrome". ... VTI Actions Go to function call
1/5	Information Stealing	Reads system data	Spyware
Reads installed programms by enumerating uninstallers ... VTI Actions Go to function call

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Before

After