Extracted

• • Target

    de56d065b92c19183aac896da4490289_JaffaCakes118

  • Size

    123KB

  • MD5

    de56d065b92c19183aac896da4490289

  • SHA1

    5b555cbaa139169d2b8deca55c5ee2df31779aa7

  • SHA256

    b8c197c2c09eb1d97b29add291520536dc305ae2665910b1b1fb2db8e1ae6d5d

  • SHA512

    ff7ee41a17718ae6b8cf582f7e260cb1df23e7b7d6beb9db3e7143ef53182964442aa1e61e58c6973ea80b4fd26fc3d840adfcdfb1e05eb3e32fb03daac5dc54

  • SSDEEP

    3072:7xHBWuljCbZ2hqSMCw5wbdTTf1N/zZYj:7xHMqubZLCwy9v/

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2