Extracted

• • Target

    fee9a9af2dbe1701f645753c4ba3e098_JaffaCakes118

  • Size

    172KB

  • MD5

    fee9a9af2dbe1701f645753c4ba3e098

  • SHA1

    f667e46039e4be556349adcaee4265a13dfe4c07

  • SHA256

    0d24a19b70fbe4bc379c67e1ebdbbba1d66f686c51ede9c34777eb08f1ebe27b

  • SHA512

    3929997bfd89ebec4b42bae1701a453c28e0ad72e867cb8141abcad53ef7bb5c72a8b0ac542f8b399b942f9e2dd10192d7bb0b3d02569e41d1c2ddf184419313

  • SSDEEP

    3072:WOg/IG6KK9iZd0aUIMXFX5Td4hKLCw7B+ibtzVAXf/T+OuWEI2cvPb/mL2/16nrV:WOg/IG69C0Rw071pzaP7vvT/mL2d6n+s

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2