Extracted

• • Target

    c93769c7de2d8e9c243fd210c6859dd5_JaffaCakes118

  • Size

    86KB

  • MD5

    c93769c7de2d8e9c243fd210c6859dd5

  • SHA1

    36837eac034c5247655c06ba358c97086793b4a6

  • SHA256

    fb0e913ad7d5e4a1061a6575c8e227d3bcb823cc1679b1ea7b1a7bb917de53d6

  • SHA512

    a207c6aa6ccffe6cd34816fe8312158c3f856b90c7a3e615a495da00f8b85807701596d907d90b6d6780b2dbb6439b064ce736e305a6b6a207e992401fc5db9a

  • SSDEEP

    1536:NHHcQmCpgMFqg7NrR/U22I6Yh/NtL5+nBZbsaQq4NLtEn8ljT:NncrcqgBR/r/Np5EBZbMZ9tEncj

  Score

  10^/10

  ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2