Extracted

• • Target

    762135b8c14114d19c0806017043ba6d_JaffaCakes118

  • Size

    68KB

  • MD5

    762135b8c14114d19c0806017043ba6d

  • SHA1

    c841141977fba7e5c680f20763bd9426af193187

  • SHA256

    ae34558e24fe7287afaac8b8238d0d38bb66fc5bfb99e6395564bb0d27ab87ee

  • SHA512

    7392ee092e82ef40c000c3c38799290e2415babe00c0a8a149ecc564ef1ac16fc18150a777ca5e02f4dd8159df95920c07de65ebe13d62e942bf2b7aae954887

  • SSDEEP

    1536:eq/X8FSZ1OLOQQgJEkQ3aFMB7se6Xe6rl8UcjYn:Fv8FSZ1OLpQgS56LNx

  Score

  10^/10

  ponycredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2