Extracted

• • Target

    c36a4be86d70b011ee01d1bb90a958b2_JaffaCakes118

  • Size

    100KB

  • MD5

    c36a4be86d70b011ee01d1bb90a958b2

  • SHA1

    360815c31844e151652c336f29d07e4a76f277cc

  • SHA256

    a87d44c8ec1a5931fe54901ce25b9d1cc0e1d5f7074c5c755a16913536fe0f33

  • SHA512

    c0f25cc7d4d7eabb0d1a08f0ed9ad18347b4ed370c17ee0479d887f460b3799a4bd49d30668985cdec0641651e85f0c6e72f4b8d154fdfbc8fab9bc3f89ddf1a

  • SSDEEP

    3072:ZnJ+21vj6xcBqK8q8UsOGd8lSgdD/spOYYY:pHucE1rOSMDEp

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2