Extracted

• • Target

    867cffb956ae12a21e0daad22436feb7_JaffaCakes118

  • Size

    101KB

  • MD5

    867cffb956ae12a21e0daad22436feb7

  • SHA1

    6d7e2b2bd6f28582dabdcfd8883984a24257d6e1

  • SHA256

    50fd528f94d745fac1e95ba0331b224ed921efc04b6324c3cee4bf087c6d39eb

  • SHA512

    d3ce2a0ea67ad4ee3827d31c26f9977ac068829f025e8ee54f549d84ba709a4dc3e992aebd4e7988762bb2df98c4f9e07de55b5d5014d126c8ff911261193e26

  • SSDEEP

    3072:1H5y7Jg9/bCq5pKFgCaa7NIQTvWbXHQiLwwu5I:1Z+yJGqivaQj7Wb3QP

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2