Extracted

• • Target

    10724ea6e84782c76963dbedc79f7531_JaffaCakes118

  • Size

    99KB

  • MD5

    10724ea6e84782c76963dbedc79f7531

  • SHA1

    5f4ca5f253878c60b5f565bb32acb093f6d144ee

  • SHA256

    d6369bd3689156d89fe3d4240339277571c9f30f491025b676fe82d430b55c2d

  • SHA512

    64b29e5b93f1116bc34b3c87e254572c4d6fbac96b484ff34584bf1427b23879f845fd6cb8eb76655ee842bb1662c3b089ada406bc379cffa8cf130afc3f4f5b

  • SSDEEP

    1536:+hC4+aTrFwihHs/aNtGWHWbiY3PT7XJCTQ2wTGy1NP/pJtlt+MbRji31xZg:WCiTjHsKt/qJ3XXt7NJJtPRG31D

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2