Extracted

• • Target

    f215fb4cd3659ff6a0e7bb669a64fbec_JaffaCakes118

  • Size

    254KB

  • MD5

    f215fb4cd3659ff6a0e7bb669a64fbec

  • SHA1

    102cd7a986675058ed8498e74731c3a6291b3458

  • SHA256

    07d28fe0eda54f8480bead13413196e5694d313b6f6f18e074a6d9a1dff9bc20

  • SHA512

    f58151464b13ac9c3755df9586604db9a901976574cbb937095cac549633bbb4aa721ca7a00559ed01f2dbfa0190e4ce65b2513ea42cfb62b2aa6575f21305cd

  • SSDEEP

    6144:JPYV/+Ja8gnRIpZT8PK6hto7c9hnTxUOXmbJtKma5:G/+JaTREZT16PIOnTxUOXmbDKma

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryevasionratspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2