Extracted

• • Target

    b53e01ddbe498d14bc2a1e6386fe96c5_JaffaCakes118

  • Size

    161KB

  • MD5

    b53e01ddbe498d14bc2a1e6386fe96c5

  • SHA1

    ea85db581c3d5795fe8a234e73eff06b943bd2cb

  • SHA256

    307f288685efa3681555e207e637a7a3b7b1f8e934f560c936a5ac03124f8d1b

  • SHA512

    558ad5f8705615cad3182d72979fd09c47db8a14b7b266bcbc538f2cb752ab738d2a96316b918a5ee82937c3c4886e6ae725a084013b2a873770d81673a9e1af

  • SSDEEP

    3072:siTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKnd6:HTLFuD6fOXlql/GLJrqqndtndhndKnd6

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2