Extracted

• • Target

    f804946c658f42bb618f72848557f1f5_JaffaCakes118

  • Size

    100KB

  • MD5

    f804946c658f42bb618f72848557f1f5

  • SHA1

    1058d2ce5b17614026a0f6494b934173dda8c76b

  • SHA256

    6d539d27dfb8abda6a8e9afa47620cc6066599d764afdfdd7d3d65ad57ad8a3d

  • SHA512

    4c88b4da2514d5fa98cadeee30d45e24e012bd0f8e8246b30bc34fb3fb9d43ad108279e59116fd7d0380ca2604894bd00578457f233016bddb374d1ebaefceb7

  • SSDEEP

    1536:ERpOf+9anhkhlRvjMdI3v0LBSgCMRjXzvtwsEXRbBHcHJeS6apaLSWVGqZP:EufGah8TMI0LBSVMR1hspcIspaLXh

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2