Extracted

• • Target

    67dc578d7fc91ede0b6937ebe16d1c20_JaffaCakes118

  • Size

    92KB

  • MD5

    67dc578d7fc91ede0b6937ebe16d1c20

  • SHA1

    5264a52930e84d21bd99af946b357527ac4e811a

  • SHA256

    d0819110618605c9a4b6e9062dc7bdf3b3cb512df1d404dfd424ec5a8b090f43

  • SHA512

    13a2f04bf154f5947523b8f3bec512c50c95a4644257c3d1e61d6e8646911b7971038408e0554caaec4204a65b5da835770de4c43c544797c94058076bd1a0bf

  • SSDEEP

    1536:fnunlu+raHbGrBTDA5Kj2WcMRl7L3HFSFqAt3rj8sQOdugZ0IdckHtLArdXM:faSHUfXjZ3Iq08sQ+ugZ0VrdX

  Score

  10^/10

  ponycollectioncredential_accessdefense_evasiondiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2