Extracted

• • Target

    f6e5a0da6deb3dd844365912b59a2126_JaffaCakes118

  • Size

    145KB

  • MD5

    f6e5a0da6deb3dd844365912b59a2126

  • SHA1

    8e2015e82cb74cf39f82813dd5abf0b1f4a8fbca

  • SHA256

    5fe463955e90ecafbe55da40620d633668f02fb1ec64fc0e7cdc9a779088479a

  • SHA512

    87b4a68bc6ac1af4a3c15b5be0d45eb3b75dbe37d6451a50dc041440dc29eb0e96042de9d44c1b64e2103a804fbdc368921ea25b8ee34bb3afda9e3288650962

  • SSDEEP

    3072:J9PkQIQY2jhkRarEdTVTeX347V6u+NZo/rkAq32Be417gfovR9:HLP2o8TeX3a/zq32Be41EfovR

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2