Extracted

• • Target
    jaffacakes118_Trojan.MSIL.Agent.forl.cbf0aae70017d14cd57eb3bb8e1ffd98
  • Size 146KB
  • SHA256 05970fe26b11ab1a8b413477ca3a42ab9fbc02081f708d7d39b90ece83ec91f4
  • MD5 cbf0aae70017d14cd57eb3bb8e1ffd98
  • SHA1 42f90ca21650ae3cc653cebd162d716d9b5c281b
  • SHA512 b37e4363e637d66744b125bd75e157f69e7eb31b69d13da9c85e41dda2518bd730c67d4d0749f48cb0e9c14d0feae4c68dad1b8d08bdeb5c3b2a94fcfebab471
  • SSDEEP 3072:AsowSdmbus4ATtTY54bkytZuRGb9p8rZ0T+SYcOZN:X6ZcWUvZlnr
  • TLSH
    T19CE3C003378B1321C5A491F688DB291403FE9BC27733D72A3E8C2A7D5E62792DE52759
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponypersistenceratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2