Extracted

• • Target

    JaffaCakes118_602aece9b731000374429508d2760330

  • Size

    113KB

  • MD5

    602aece9b731000374429508d2760330

  • SHA1

    b69a027cf72cd491ab2c626c9b5bca97a04eb5d2

  • SHA256

    d3582d43ee2a97561fda263c41adbf8b1e2cc5d5457e98dac0f18356ae97de3d

  • SHA512

    db2f61337c295a4c605fac54c0aefbc51940e7555199d1d13a14a0681f48fa8f212eaec47e070baad9ce2f3de2810bbc6faf5f7389e3ddd9f26332b10534cffb

  • SSDEEP

    3072:POQXukKwF4/oAk2be/xHTYSnLpuiuSDe2:KkKcJ2beaSLpuiJ

  Score

  10^/10

  ponycollectioncredential_accessdefense_evasiondiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2