Extracted

• • Target

    ba9834eaa4bfda2cc70980d24ceccc47_JaffaCakes118

  • Size

    99KB

  • MD5

    ba9834eaa4bfda2cc70980d24ceccc47

  • SHA1

    9f1e6ad54226ffe3aff31e468f4a6b3ec3ce760b

  • SHA256

    6d4dec54d7ba8361e5a840d6a92daa356fa3a217ce60f3d75bd17458fb109efe

  • SHA512

    dbc35d38faea0cd38d82baca3eda0fb5c3871681ab84628a60ba66d2991fdc6c6b1768422204651d8ebf5e9f25ec54556e92d35538a17429ed7f07f3c528a47f

  • SSDEEP

    3072:dh6n/vTn1NtTXkclKEyix3j9INNxq73EPQc:dh8b1NFkcgAUNqP

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2