Extracted

• • Target

    1805db20ac34804e80ca4ccf797b5bf9_JaffaCakes118

  • Size

    98KB

  • MD5

    1805db20ac34804e80ca4ccf797b5bf9

  • SHA1

    410645a3132e854da569a07233fe81a748d7b1ba

  • SHA256

    ba668e13f354020465dceb90ab2cd059531733d7ffceb0c828e958c0716b5752

  • SHA512

    ab01d600e79a4ff643f505573cc4b65ce857e4cc90b0c4ebeaea64f87459aafa6a1a5a3644b9df8bf150b800501d780b08dc85e025611cb3e7ec3a9c2e26addd

  • SSDEEP

    1536:sPdNy3zltZRf8IHpwFrpMiw2pgRhufp8opO6rS4:sPX4XrWM12pgifawX

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2