Extracted

• • Target

    756a011b6fbf8d93e36872fbe304d289_JaffaCakes118

  • Size

    92KB

  • MD5

    756a011b6fbf8d93e36872fbe304d289

  • SHA1

    b2bdb26d73f21e217c15c810da896527cbd96af5

  • SHA256

    8de7dd4c4f11c5b83fb1b0cf219a31bfbb3c230a1422045547c755588ff4cfb4

  • SHA512

    1733a7cce5a21c9077084a9f2e95ef854b8b7674c0b3942fcde7c34cadc8e41f95f87a23b25f445656e51038f67388900326e44e92e7e8ac4d268af01d52f601

  • SSDEEP

    768:2diOM5DCMqGtsDxYVF1IV6CKpWH64MbCCq7qLF27TUatZx/+fi5EEf5WxKR2cN:QEsGtsDx0IsfCCWkMPUatr+fifEi2cN

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2