Extracted

• • Target

    7ed758155a9db633082cd1eaecaaf966_JaffaCakes118

  • Size

    263KB

  • MD5

    7ed758155a9db633082cd1eaecaaf966

  • SHA1

    def042db95b35380404766952ca6a603f4ecdba7

  • SHA256

    cebafa254c987723f0ba926aeadafec05190d65bbbd3f2df68002a70ac633309

  • SHA512

    2850584d2a7249c94d535b3264868b6568a5f4a7bdb7ff5595544444956dafb4091fb0f5523a2e66b0eaf4bd69a205b5fdc0eed729c6432089d7f68631072aa2

  • SSDEEP

    6144:PBsQzm6wFA/qKjDth5SxZ1wy0WxmRNLdiwS+o9XH5:JsZ6wFA/qyD5p6mRNLdbDoVH5

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2