Extracted

• • Target

    ba662d12b487eb429547a156557d8d09_JaffaCakes118

  • Size

    99KB

  • MD5

    ba662d12b487eb429547a156557d8d09

  • SHA1

    fd129e59f29306537dad28368f483b8ef16e6dee

  • SHA256

    610be8761a0dd7ddad74c426474e780158aa534f2e7c42ea0d822edbf451aa6d

  • SHA512

    55c829e4ff043ec312425c03218e97820c2be3db21759f3e2bee481548003dad4e62d46463adb019543034bc13480be70265ac9365bb1c5e627d243534fde5e8

  • SSDEEP

    3072:1QS7+h7WCRV/LtwKGxlTX+i5BUYgyJiVB7KBf:SSY5/LtUxX+i5DJiw

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2