Extracted

• • Target

    c8b4e1b7f8e86a3b4e83f5901fd71b6e_JaffaCakes118

  • Size

    140KB

  • MD5

    c8b4e1b7f8e86a3b4e83f5901fd71b6e

  • SHA1

    eedf54ea06919945e6ffc4cff94f2feaf6a3ef25

  • SHA256

    9cd884f2afea1a7c656e3d0b0211f6a3b39edf599cd6e6a61df5105ddc0c6caf

  • SHA512

    80456fb3d829fd1e29665df27f1ba2974989ab31874f806b85a84b63a1efbbca957e24c47447a08ab1d2ba7238ff01c06c4969a5330993fd565cb5312fd112f0

  • SSDEEP

    3072:yzq23oDzpeW7f6SgaS2jbxWGq0S2jbxWGqCy:okzoDQSbGq0SbGqCy

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2