Extracted

• • Target
    jaffacakes118_Trojan-PSW.Win32.Fareit.djqe.4ed7bde7af258437b22815ae6e8416f7
  • Size 695KB
  • SHA256 e3dd3f61c64b2ff1b25c6d05a409ffe17330c5529f894b17b59007e63e444cee
  • MD5 4ed7bde7af258437b22815ae6e8416f7
  • SHA1 c2613694133bc56c34b19d2cb77456bb36ff7c77
  • SHA512 ca31c711418b4ffda817d718fe77711e200a3788634b449eae898552ac5a613ded743e7b3a5d9016091bb03b45c67dd37613756d04671f6fe9d2b269934f3358
  • SSDEEP 12288:8vH8wK/KbewiS+vUyWwbZjijOsjOEbK0fKqf8yLYaEIzb3oC3B:8hKuj+8ydjNsaERfKqbIizD
  • TLSH
    T1AFE49D72F2D04833D1B716388D5B97A86D36BD103A249A8A3BF41D4C5F39791392A3E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionponyprivilege_escalationratspywarestealer

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2