Extracted

• • Target

    43a99dc2967b61e5727d32a5399b0e78_JaffaCakes118

  • Size

    104KB

  • MD5

    43a99dc2967b61e5727d32a5399b0e78

  • SHA1

    e37986dd6b9f128333a4f0e9047fd2f28cd81740

  • SHA256

    028cba5047a6a3da70197920cd3b4e5dea9284a7e9cf5ef05d9ec70849054053

  • SHA512

    a157c1f7f40ab40b07df4fa22054566999fe781414fcf0e5dab0744015632e6a00264092b98b3acc98476af36196845e227afb11659ff3337dd11cb6d16a8722

  • SSDEEP

    3072:a4fyIBSwp7YBnjwd8rMrW+rntdvkGLDE:aDIBSwejOSV8ntddL

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2