General
-
Target
dc0b3828159e9526a1f0b18f93dc372c_JaffaCakes118
-
Size
155KB
-
Sample
240912-hzyyyaxdkn
-
MD5
dc0b3828159e9526a1f0b18f93dc372c
-
SHA1
49a69d2915b2116161a9d7ec437ceae945a0b69c
-
SHA256
bed3a73572c129662abb800140dc778b1de2f004bb5943d443aacc9cb151b790
-
SHA512
fd1354a35620e7a830f35773d59bad8f02112e8c54cf81c828236f8d68b6091aa191e365711f0b1b98aa7fb33b57b0a4496a92df84aa39879aa09e2d226137d8
-
SSDEEP
3072:PG0dX1/CfqGeizTajibxf7VqzG4tKXWZnguTgLOob:PBRKeivJbxf7qHdlmOob
Malware Config
Targets
-
-
Target
dc0b3828159e9526a1f0b18f93dc372c_JaffaCakes118
-
Size
155KB
-
MD5
dc0b3828159e9526a1f0b18f93dc372c
-
SHA1
49a69d2915b2116161a9d7ec437ceae945a0b69c
-
SHA256
bed3a73572c129662abb800140dc778b1de2f004bb5943d443aacc9cb151b790
-
SHA512
fd1354a35620e7a830f35773d59bad8f02112e8c54cf81c828236f8d68b6091aa191e365711f0b1b98aa7fb33b57b0a4496a92df84aa39879aa09e2d226137d8
-
SSDEEP
3072:PG0dX1/CfqGeizTajibxf7VqzG4tKXWZnguTgLOob:PBRKeivJbxf7qHdlmOob
Score10/10-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-