Extracted

• • Target

    0866266487d7163e0c737ebba560e36a_JaffaCakes118

  • Size

    89KB

  • MD5

    0866266487d7163e0c737ebba560e36a

  • SHA1

    5756954016f18f206976a2109c46e817cdea8f57

  • SHA256

    84519fd55c8d1d5e579b2b9eafd577659a9a912abf68cfef91d049809654d765

  • SHA512

    c12ce83f4b99cf2360159c637637200f8b7138fd28e43435ecbf31cbbbd7fecb78a6cb752d7ac31d957c43d27a01ce6318b3caa2f8f57ec8da269497a2bc432d

  • SSDEEP

    1536:dJM8AHgqTHQytj2sGldxIJ1A5tSBu2ju0mO/4vJTvkE47qSkzZz:LMRWxIJ1yt2SO/zE4G9z

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2