Extracted

• • Target
    jaffacakes118_Trojan-PSW.Win32.Fareit.eblj.2c2ab06be7e1a7756c97c749740526b4
  • Size 628KB
  • SHA256 6643a9d8f5790c320094d5b1cbc92d2f41947dcac1f2e7affbc91e0c59281af3
  • MD5 2c2ab06be7e1a7756c97c749740526b4
  • SHA1 94188474515bfef8fb1fba14fd576ed73772ed81
  • SHA512 60700884dd5fe2a2bf1fc912739c9fcc694ec91cedb7cd090a5ab7a2196071b26d0195af238a87018bc996ad60219915df8000dfc51f859f2f41caacef95d1bb
  • SSDEEP 12288:5H65HqO7EW+/amXnMIW/Ti3xRT3U4JYDYZB:sAL/am8V/u/T3UiYDY
  • TLSH
    T1B7D4F1D7F566E5AFC85383FD1A0E9D561E92FDB48245E80A2F61025F406B6E38C4E80F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2