Extracted

• • Target

    49881ad5a4e7ff571d1a49b20aa59e98_JaffaCakes118

  • Size

    84KB

  • MD5

    49881ad5a4e7ff571d1a49b20aa59e98

  • SHA1

    2e0b51f491d97d9c019a5d036ea562dc98d006a0

  • SHA256

    acb9d0191ec6198145cb575aac3fca45ba4fd8138a7faf447a189d5917043631

  • SHA512

    bd7c1d8c8abe158dc356baa1a053fb14d2003aeaa3eab5b461e55cf34dfb3286174d0551ca0863acbfb41fe377c8a278460f76ecd892d3ce355ae41fd97d960a

  • SSDEEP

    1536:zurTR4UUbBBHFZnT1m/taX2Q7SBByelm5s0nrneZhmoyaOeWQDhSJ5Mz8I5702NF:ieUUVcAdu/1Y7e3KaOteSG54YYF

  Score

  10^/10

  ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2