Extracted

• • Target

    a3bf414a1174afe528d6655fb8bd3960_JaffaCakes118

  • Size

    99KB

  • MD5

    a3bf414a1174afe528d6655fb8bd3960

  • SHA1

    2ea94f9e06d37e19c1ba563832e8429a77b07ba7

  • SHA256

    8d3132c1473de82bba3997038e9ba2482b503a03692105cf947a1c029235f83a

  • SHA512

    81c54ef814d6611119f26be386627c08c9e32821b275d5b084fd82c6efd30f0a3c53ff88403723caec76a412c4e0e73afcdaf4b52c07344abdef1e86ea29a6ce

  • SSDEEP

    3072:fjytSHNiP8NcYKLtZeG8KR8z/Cgdt1Al:WtStiC/K5ZAKRS/Cot1Al

  Score

  10^/10

  ponycollectioncredential_accessdefense_evasiondiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1