Extracted

• • Target

    a7d495047ed2e51f466de166166e8584_JaffaCakes118

  • Size

    102KB

  • MD5

    a7d495047ed2e51f466de166166e8584

  • SHA1

    d1cd3d7b64b3d8ad22ddd65fa4e091c0b1ac9295

  • SHA256

    9c9cb0eb8a9cbd759910b48204e8363dfb351cd93557d0b5f13a21f217a23bd2

  • SHA512

    97d9b89270155a3305823afc38a25bed97fee66272e778b8a10a879ad6440e12ad09d047752d5dbbb152d9eeadf61fbc430fb71b5c501ab5e6076364159b4541

  • SSDEEP

    1536:EpcwmTzlnq1lPCOUlscN/7YjDKzskId4Ldpz838NmGT+:Eq52l69lPmOskA4Lbz83FZ

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2