Extracted

• • Target
    jaffacakes118_Trojan-PSW.Win32.Fareit.dhkf.e31644a205a73283e0b9479e25db55e4
  • Size 144KB
  • SHA256 89e05a947a13fa809d315e86134dcf911449770a081d61dded98dbc6881e0a04
  • MD5 e31644a205a73283e0b9479e25db55e4
  • SHA1 d7d7de5e0ea3b5c08287013811b33489e9372fdb
  • SHA512 c4ad3c12238ecaa376264de21f1b0208c32c948f940e72f7d623c1f401a270360f97ccb45d25e1a8276850140eee61b207408ad627448fa8a006a3395420d927
  • SSDEEP 3072:VUplHxffVqxP9PdRnwIqfQ2FTiChveGJ/AIVArzIVAr:qbRf8DwIqQO+8vNAIaIq
  • TLSH
    T149E302EAEB18C3B4F3518BF01D3946C4641679FB32A25D2F98947A0CDAAC9C267543D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2