Extracted

• • Target
    jaffacakes118_Trojan-PSW.Win32.Fareit.eblv.61439d92fd87a473b1fd90563f59b701
  • Size 4.1MB
  • SHA256 0bb6f03daca26903355ec7265858ed3da16aa4d7fe10f9395abb07c965f20488
  • MD5 61439d92fd87a473b1fd90563f59b701
  • SHA1 f33b41337b596b4e300bef466bb10c235f7a2a7b
  • SHA512 dab94661653469d1770d93931d4c065185d0cb4bc7333adc28320f3c85653c4fc8713a833d4e1202a701af76b00ac57bbe89bf62daf28bbb48af4489757f7186
  • SSDEEP 12288:3v2a5MEiK8lV3TkLGb4XMGyNRBpcbHhVAje8mMt4DVrCByG2uFzcuYqG5BLvpk7h:LqwuhmG8XMrR48Ft4prEySFzcuS78XR
  • TLSH
    T13E160263F34AACA1E467D4FC55E4083E0BD250558ADD8C7F74FA6F4B3E25622816C32A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2