Extracted

• • Target

    fefb8168f3137afa1840f09fbbc78e21_JaffaCakes118

  • Size

    108KB

  • MD5

    fefb8168f3137afa1840f09fbbc78e21

  • SHA1

    3537b5650a8dda17e67a8c03a991a14ae2c1722c

  • SHA256

    15d5c07523d42c1bb1b09c9d3c6c3b61b75ef8e8799eef49a79a2c3491fbd6f4

  • SHA512

    f45df46b577e78a866afd92e8997995eb7b4755f04aaa845452cd928880cde963d534b06a260913a6f86f9fb3d739786cf90d66ae944b9b9d87e8ff95c28875d

  • SSDEEP

    1536:20mwNiX6ZC8qHlLYHroQH3M6wL0a6na2qebml:x0X6ZfqH1YHdM6wv2U

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2