Extracted

• • Target

    090ac0f3fe6de10df0db9d4b54d7b4e9_JaffaCakes118

  • Size

    155KB

  • MD5

    090ac0f3fe6de10df0db9d4b54d7b4e9

  • SHA1

    1e02117a8e966b875d2a0a0cafa3873c980059fb

  • SHA256

    2b457552bd2c2f958c9a51267a4db67b8bd84cc17a9d3d21e4e69d39f64596e5

  • SHA512

    d6fb51e0a5be3228635e05c95e61a9ec4eceaaa7d1db2e3b63a551b1b483e3e77554f1dd290c58c1c1293fb236e016813a41d4d35f22f108661fb74284619668

  • SSDEEP

    3072:p7V+vy40ljSe5bS1dSelzEAOvSWLcNEDi+wjtk0V2i:Rs0ljb52b/nOvSWAf1tk0VP

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2