Extracted

• • Target

    e246287161e2b52a84b8d7226bb4e0f2_JaffaCakes118

  • Size

    98KB

  • MD5

    e246287161e2b52a84b8d7226bb4e0f2

  • SHA1

    a91d0f40443f7d7b817bfac5342f96e1f811ca72

  • SHA256

    2ca585f17c94f6cc5bb9c12217449370d27c86ddca64d6ea4592ae9fec2a27f2

  • SHA512

    17b4ba72642a2e6689b59e9ed0b1e81539fe456c17576a8e685da6b85b931afcfc289b1e3035ec48f042c94122e12d7a36f9fe63095d8eb59694423112348ac6

  • SSDEEP

    3072:hKxHfoZhPSv7FP+1j/tErAgexukWAMEAwgSUzBeximJ6:hKHQZaV+F/tyAgyukWAwtSUsImJ6

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2