Extracted

• • Target

    edf5add2eb1719403d9489550ff04dbd_JaffaCakes118

  • Size

    101KB

  • MD5

    edf5add2eb1719403d9489550ff04dbd

  • SHA1

    5ad3105e8f81d30ccfad0491c1dacd897e4511b1

  • SHA256

    6debdcc2f46275241715e4a4cbfa88be61a2f22eb1eabd702a34320b06edb86a

  • SHA512

    0bebe6198e9fb8e211f7b095aeabff23fa00db473bab72636e23e2a1abd2f7710d4f83f45edd02579e49a7ef1aa3cdbd07192b7fc17ded232013195efd8f757b

  • SSDEEP

    3072:MCK7c5Y6eC3Qza3TK5mnCyq0VPs3soEQ:MfWMCP3u2C3ssi

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2