Extracted

• • Target

    7f3913a16346193d50485061ea79b1e0_JaffaCakes118

  • Size

    1.0MB

  • MD5

    7f3913a16346193d50485061ea79b1e0

  • SHA1

    ae9051ed40935240900d392b82978cdfae28c280

  • SHA256

    62869dd10e3025be8ee4ad498214336ab2e68a2c37f7cbf3c340f2fa6854bb52

  • SHA512

    0fec24b743478e09d9c784dfd24840af7fc92b24aa29367685de6115a73c2867f3609ea252e7358dfe3a2fc94551678129fcc9bf30d2f39e23180238c38d5cf2

  • SSDEEP

    24576:U0ycEf/gsWZi6CVeHysNl0jnvH9KDCfbXEmSR8uDIRI2:Y

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2