Extracted

• • Target

    e36b9884e0eabe6cd76aedd74f4b3151_JaffaCakes118

  • Size

    208KB

  • MD5

    e36b9884e0eabe6cd76aedd74f4b3151

  • SHA1

    e98df4c6dbeb5e505026b824457722093c77feb5

  • SHA256

    ad9039f3e400adc14b58c206d8d5cec9950bfab350d321cb8c40349a165ade1a

  • SHA512

    de30462aeb3ffc85ed00ca5c195cde026f124096f25d1d73dda6beeed5c28eb6083e1325dbbc004fe662d2feaec1458329cae804ea2c84371864ee531653a7fb

  • SSDEEP

    3072:C1Q52m+tPGmjZQ84GbS2DIzG9bRDvPEw/IBAIXODpzyN0MPegMtBH0:4HumT1Dm4tscU0MPegKBH0

  Score

  10^/10

  ponycollectioncredential_accessdiscoverypersistenceratspywarestealerupx

  • Modifies WinLogon for persistence

    persistence

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2