Extracted

• • Target

    f47b7b88b19aa78a351fb715ba60b441_JaffaCakes118

  • Size

    100KB

  • MD5

    f47b7b88b19aa78a351fb715ba60b441

  • SHA1

    dc045c9db51a9e21cb2831a77484e6b561f03d02

  • SHA256

    81e894041a1e2ac34b9b046d7c589bd46ba0f24d21d5c353480cd1a816f1743d

  • SHA512

    fd16c4f441c2cf212ec5b121c1da57fdd21454446e3ba373e132b0dda46c4e76026774a2f10b610c75940dde2c6f828771f7403f37d4e1c36e8f30b39471a8bf

  • SSDEEP

    3072:lBItvBXDbbesZTVJFl4cBsiJLU3eSfbZ:lBItvBzbbPxJFlTBHJL

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2