Extracted

• • Target

    10853eb79c46a755b1b85653002ebc3c_JaffaCakes118

  • Size

    162KB

  • MD5

    10853eb79c46a755b1b85653002ebc3c

  • SHA1

    13284a677288c9101fa0928b50d62283519e4f9c

  • SHA256

    6c360e37e1930ce8d30d40e685e6b0657f4a90d5347577c793b43be359b21b13

  • SHA512

    be4766e522edcb030babe5fa10ae14b17855d466ecaa83d260c1be7360cada2291cbbe389e9e8d078edf1cb6b0a09f3d9e25b6973d84b5e749b941cf68bf7b35

  • SSDEEP

    3072:r+gWfaJ+M/2zsOYyKiHVOH8ep/vzQp45POuYfJZozp/d18:r+gWfahIHE84DE45POuYfJZob1

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2