Extracted

• • Target

    a4d01c5b34ab234e8e3322f86dc5cb82_JaffaCakes118

  • Size

    584KB

  • MD5

    a4d01c5b34ab234e8e3322f86dc5cb82

  • SHA1

    c0adee8fcaea63039885db601780de2285e6fa1f

  • SHA256

    a9ceaa74895a1a5332997d6a68bf980ecd1dfb990b7a1c8f7e691d3f383c7733

  • SHA512

    66dba69800ae34b331ece19f3cbb08c555ef203929df2b1351a6e1a961213ae71f20c7d1c89a8f3dab22a192f6b5319d8347e31ce2a9fa7170694da5dc7d664d

  • SSDEEP

    6144:MrCASHtZCiv5Jl1jMidigW4tJygbJW7fDGt4TLeWIzN:G0/CiB71jMi8e7ygNW7q4WtN

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2