Extracted

• • Target

    f8964ca52682809992e5056e2d97a2f3_JaffaCakes118

  • Size

    129KB

  • MD5

    f8964ca52682809992e5056e2d97a2f3

  • SHA1

    de97cd5947b3ce1327644938a7687e1b65094a06

  • SHA256

    0d3f6754bbd76bcd7016b6040ec163ac73ebad794ce8e5ffdcbdae3e39b2f24d

  • SHA512

    40caa28575c3fc397c83f86d9c121fc6d18a35bddc71c3fdd13e9ff9be8ced7eacc01c14195750c3e758292883027abff76d94ccfbd8716cda9c3a598a15031a

  • SSDEEP

    1536:UUBiFqtXmPmgC9McvLci0wLOQqOZD03XuCLMw+ucYmOI3JVgRYNecRmBCaOD9RMi:UOn16mg2MW9vOy+nuq4DVke3R/jrMf

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2