Extracted

• • Target

    333898a63cc9df2ae3a732a36a8b284c_JaffaCakes118

  • Size

    160KB

  • MD5

    333898a63cc9df2ae3a732a36a8b284c

  • SHA1

    62bf1662deaa4e64e9f1d3d5dcdb1fb8080c4852

  • SHA256

    b9467f2db740252613e72fc7cc441c46e6625730bab6e1331d3bd92079311721

  • SHA512

    3976f70a385baf9eefa94409f0306e084bc8e3f7e4060ed464df301d27dd9603858938289a6d09c3d58cf26bd3c607a8c977b754e69b5d845c252ea33e576ce4

  • SSDEEP

    3072:AuWJVrzbzQUi36YK2kKIsGcCoYxXSn2PNENxk5pNuPn2SSd:VWJVPj4kRT4CXLPNge

  Score

  10^/10

  ponycollectiondiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2