Extracted

• • Target

    0ca6628f11932a399eaad38630233420_JaffaCakes118

  • Size

    96KB

  • MD5

    0ca6628f11932a399eaad38630233420

  • SHA1

    5ecd5ca152d318ee0853405bbc98b1cee40ce372

  • SHA256

    79be4345a7da6ac60329137a7f524d47a3cd32cbc979cfcfc3c749fcf84a942f

  • SHA512

    c055848f2dc006826e92cfaac30a437b951f7916cf637c0591dfa7ac29dd728648f269da68da53d895aefa5771b15da834d3c28c40c4ef186b6d846204b53da3

  • SSDEEP

    1536:+LptW7wYTUB5sfDjw9D9XC0m4yyFD/nBb5YvAeSi5xWUJORESTutLgr:OwpWSjwVdZm45L5wAemuNSae

  Score

  10^/10

  ponycollectioncredential_accessdefense_evasiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2