Extracted

• • Target

    c84efb51904286ea8302aa8ed1bd452e_JaffaCakes118

  • Size

    129KB

  • MD5

    c84efb51904286ea8302aa8ed1bd452e

  • SHA1

    94c91d23dc7b591cc93708bb30c2e73e3eb31a19

  • SHA256

    6e29222ca2f7c7b3062155ee9a15fbbd98008cd536435d8451af2d8fd6d3fb8e

  • SHA512

    63cb9749ad452a2cf1453a8c9c04efd50db310c22d61d7ba4b3b5b8745b39bf7354963feadf05e70538bf7d3179d692ee8dfe18c4ba062f0fe49d3c6f8c00a81

  • SSDEEP

    3072:UOn16mg2vk6CK4ZTU1QWVTEa10jVV6rIH:DT34ZTUq0EaOjVV6rI

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2