Extracted

• • Target

    f47282e07efeda358b6d03a625b606f1_JaffaCakes118

  • Size

    144KB

  • MD5

    f47282e07efeda358b6d03a625b606f1

  • SHA1

    daafcce5b93a4053a2bb2bec24fda3879b34be1f

  • SHA256

    cd74b63c77301319ce16479425ac0c7847cb96dd1bcab2b7b43fe3cf2f8a5f62

  • SHA512

    a65e61df5860513eafc3716fc04aad02aabe885c5295f700dfb7babaa42e1314232ed30ff914d6fe9b28b30d114fda0f371434bf560b9faf515f80f4aaf2cad9

  • SSDEEP

    3072:s0IYwk7xA1oEXN9QkZNGOXkTdCtLfbuCQpZZepaJ2bZpk8:nIYwkdUN91NGekTgLbSAaUFpb

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2