Extracted

• • Target

    fc4a13b21b8d34ed0e7f2d3bdbc37d4e_JaffaCakes118

  • Size

    190KB

  • MD5

    fc4a13b21b8d34ed0e7f2d3bdbc37d4e

  • SHA1

    e4b07806cef3c26f61940663e8c1aa73318dea51

  • SHA256

    67323f1798c2e845d52b7a7d63a436170268a92f3351934833c1ce3f8a064900

  • SHA512

    74d9fc46f3234982011701f272f53ae4001de0a8005dcc76110f90aab9c8c581c7935b4eb2ca9285bb1863286dca584178f20484def9c8cd754ffbe6aa518d8f

  • SSDEEP

    3072:vOfAbt1dj2pDE6JHvr48gBs+Zaupb3coC+oF30SN:vOmXqLJPr48g/ZolH

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2