Extracted

• • Target

    JaffaCakes118_0db510e54a0304fc4d25354925b58642

  • Size

    188KB

  • MD5

    0db510e54a0304fc4d25354925b58642

  • SHA1

    2a6db463f338c79edcca20be7af89cc5fb2ace26

  • SHA256

    ecc4e9d75b1f4f4bd4fa7aa43c027bd2c4252a5a8e57f96b62133a528c0ac44d

  • SHA512

    60092fdfbc71b2ff300598be506b8551a17935d5ec215387633dcc2dd9ee996fdebc64dbb6b2a86ec430d5cd74ba4eb61c27fc2f9b1bd508fe52304a4d9f3ebc

  • SSDEEP

    3072:YRCnLqrIKcxoj5QLa+l/a89VfVPbgjjatE1AeuLnruH308ut:Y8OrIKx5aFl/a8nNzgjjMEmVLr+E

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2