Extracted

• • Target

    0370f3a4367e32f97022f57e89347545_JaffaCakes118

  • Size

    99KB

  • MD5

    0370f3a4367e32f97022f57e89347545

  • SHA1

    ac0bdcac53410395387611a2d62fc9b8ab9e9d80

  • SHA256

    fcd4a06ee44033215b7fb8f7955a31ee5b3a1ae7806dd0704d93873344369c8d

  • SHA512

    4af4bcfe82118ec7d96efb596a51d5dce438d245b7a46f42420fe47b5af46a0a843face60fc8c2cc4bcaa473166ed385d0479a73f67a7c0570c1c5a363db76d4

  • SSDEEP

    3072:ZO9D3+M5N+H8ygWQcUuNP7mpO7hHwJFc:Gr+UUgW4u5hwU

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2