Extracted

• • Target

    73a0c169c0d965da5aefb31c067798fb_JaffaCakes118

  • Size

    101KB

  • MD5

    73a0c169c0d965da5aefb31c067798fb

  • SHA1

    1517b2fc82b92aa08762e9a9df0235e78fcc02ef

  • SHA256

    84e29e734cc39e89321e72065b391a804d5e83c8861deaf71e5cc620aa8fe216

  • SHA512

    d57338136d60aab63b59f46dbe8ff4522df0013e8be338320bf1a9c1825f2fb44dd7f1aeaa1350d38835eeb3309ecdb1e5f13813e8070ef07d9360f0fb4acd27

  • SSDEEP

    1536:3r1VNQkOFoIT0VahcQAamxSjSDomtrh6+jvDr5m3ibP/bnV2ANVMCM:bdQPF1JmxS+km8+jvPg3ibP/R2c2f

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2