Extracted

• • Target

    ff3cdc777b5071277f542ab4d57f2d80_JaffaCakes118

  • Size

    128KB

  • MD5

    ff3cdc777b5071277f542ab4d57f2d80

  • SHA1

    b4ae157fad8afdf26ec65a17d1cd7d0d49a84162

  • SHA256

    8eef99bb9aa49974759868ae9bb23578177a64616101bb24da7536e0fee3923f

  • SHA512

    4d428dbf0c7e864c69a15a4db2f5a50f0333999b3481dfbf7829108e531ba1d09c196ec8633a07da75b02cc3bbfde398c5a25b0fc0900d363161dfcc1bc58577

  • SSDEEP

    3072:uGHi6mwKuRP5oNRw6BxqzF4tKzLoxqDHyJVPhwcj:+lu74Rw6B3tKz0qDHyfPhf

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2