Extracted

• • Target

    87b46fe2b2ceff0dfe64e6281461616b_JaffaCakes118

  • Size

    1.7MB

  • MD5

    87b46fe2b2ceff0dfe64e6281461616b

  • SHA1

    4c7bb0ac45d49d5816e248c01bcb49d4cec0f44c

  • SHA256

    881c33df2425c99ffcfc7e0d25a71eaa8c3506547455215ceed049d1d996aaae

  • SHA512

    a777889048260ccd44806d847f81f0652f32029c72d6231ad2d6e63388444a27171b01e95ccb8d5ae91724ea075a5da36478d1dad205c382bec41c68c7c10f4d

  • SSDEEP

    24576:Eglz5Mt0fUnN8dFWZQ1lK/Hs7hgripm6J1BGCQUjSFFFFFFyk6o:k

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2