Extracted

• • Target

    d654569d7d9413030171208fa0a4d271_JaffaCakes118

  • Size

    100KB

  • MD5

    d654569d7d9413030171208fa0a4d271

  • SHA1

    b51ab8293011d930216659e41bc31fba51ca0009

  • SHA256

    706349821375e943a4ab59a92a021e13034364b334ffdd9d189160fa539f3c3a

  • SHA512

    7ee2c245b02e154c70fa42c0731ddcb8f363f6765e59dde1b7c1d4de572a1dd0b4c44650e433f6bac61ebb1700e22c500cf5125f4d860f44ee5bc5feea42986a

  • SSDEEP

    3072:L8AeDK4tPjrO1DOyCL/IVxDrYx8xt5yyM:L8VK49jrO1DOyFVVY8x

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2