Extracted

• • Target

    dff2a2872c271154b4f3104815e852b1_JaffaCakes118

  • Size

    190KB

  • MD5

    dff2a2872c271154b4f3104815e852b1

  • SHA1

    3429745d8a73ebadf8947bf9a20f7ae3cd7c6e77

  • SHA256

    c6093a74b143b3bde114f50975742a9e17a822784809ea982a067a2484ce9670

  • SHA512

    3279115eaf1442e7dd420162ad450add70a3b503064d3bf88799f3ccb4d7712821693ad8a9ad768389c3f3ff025104806abc4f0c376ce8d37eaf179cdddacf94

  • SSDEEP

    3072:47+xUwIkBFanpt0d/BgHVvBW+ZbYCGYnd+oh30ST:47ljzpt0d/BgHVvFfMohl

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2