Extracted

• • Target

    fd757a2822a7e82f119f2394784aa647_JaffaCakes118

  • Size

    99KB

  • MD5

    fd757a2822a7e82f119f2394784aa647

  • SHA1

    ef6db0d6238d4a8f2125ffd747693c75b9994db0

  • SHA256

    3d4cc300770736670ce47e11da99141d4404617ce617045b504c59333dfb0c52

  • SHA512

    a1999e4e2e43d9af9df4643abd78f8cfd3bf5df3e9bc2777acc657135cb8cf7f1df5a887b4b4ca535784cb7a1d3b0681f196b88235c5eb86c955c83190369729

  • SSDEEP

    1536:HseA3lVz0r2szc3jyHbf4wOQETNY3f6QwV67CkdMFCAr1Ke3otnr3y:HseAjzKq3jy7f4jWyQMkdMFrkgoTy

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2