Extracted

• • Target

    120823ec85323a0ae96a84e59ad61f9a_JaffaCakes118

  • Size

    190KB

  • MD5

    120823ec85323a0ae96a84e59ad61f9a

  • SHA1

    9c59cdd1334a85a1eae3b25d41746d82ead724af

  • SHA256

    8a76ea1499c3c4a876fa0b2aea1ec4c216e183ab8ed27a153d41474544557e5b

  • SHA512

    dcc2b461a8c186556a2b500171424d87aea6d6bb9e83d28af27875efe3f724b2b8bbd138e9d002daa841accdeec918f4af27a6113ee57860e9cc22f56747ccc3

  • SSDEEP

    3072:HwdWBSPjeY3wZhwTtWt6vHW+ZbY/bWcxueoH30ZD:HwEM1AZChWt6vL69oXW

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2