Extracted

• • Target

    ecdc5976bd2107813257013dbe454570_JaffaCakes118

  • Size

    79KB

  • MD5

    ecdc5976bd2107813257013dbe454570

  • SHA1

    49cbeb1d5f59ce58d5c4388a226a0f50b0b33922

  • SHA256

    27fab44561f2739e419a8a4a03f5241803c5d692f3ee902003ab139c790adf6f

  • SHA512

    f8de4998acd10a6e5eed84471179f477fe4e1ba40e3ee6ca0067c73cf891b81bbe1dcc9b1ee40f7e3765d7dbd2bfdf096237995606424274a8a48ec752c3dcc3

  • SSDEEP

    1536:St7l76UjwBNcysxzoJm4IQPuR29O6CqML7LUot/wGDW/3hl2OMZoa:o168z2eQP9O6ML7ZVwKWvhCZoa

  Score

  10^/10

  ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2