Extracted

• • Target

    e597b554c38f7b456eb61b37e6027dca_JaffaCakes118

  • Size

    79KB

  • MD5

    e597b554c38f7b456eb61b37e6027dca

  • SHA1

    e4474f8751fa4f0d3f58f472010585a4dfbfb5e2

  • SHA256

    fb6392855af88ff9110f093133e1d384e11819d8f011149287c7874309e42d07

  • SHA512

    a2ca8a475be62acfc49f7befa97411468dedfbe8e3e233b883f10fb2b8a7450fe4bbd12c1f1f070357e669bb76842098153c877b4a8293c65552f0427b4bde12

  • SSDEEP

    1536:Yt7l76UjwBNcysxzoJm4IQPuR29O6CqML7LUot/wGDW/3hl2OMZoa:a168z2eQP9O6ML7ZVwKWvhCZoa

  Score

  10^/10

  ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2