Extracted

• • Target
    jaffacakes118_Trojan.Win32.Jorik.Fareit.abw.9a37072d697616d7f7299af4848bc3ad
  • Size 131KB
  • SHA256 fb3a14beac5c96ac4dca6aa904e3382e8ee4d5945bf35f321fe5dd202e9db50c
  • MD5 9a37072d697616d7f7299af4848bc3ad
  • SHA1 174ae485b706af40cfb88bff775c11efe97470a9
  • SHA512 7ef113dcc5e370ad20b558f1894d17ae2caa94cf6b487103faa5482c6dbebe6f8cf8b5019ae39e1191676de93dc81ceed9967f7061ca113cdb01193fde4464b6
  • SSDEEP 3072:rP6QXHrfXBPE85j/rJYaVxdTQWrPppppZppppppppppQppppppppZppppppppppp:rrfXq8FrJHV/TQMPppppZppppppppppI
  • TLSH
    T1DBD3DF0BAAE1511BDC4B4FB143F5A2E691252C408F42A6D797E8AC085BB31DC586CF7F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryexecutionponyratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2