Extracted

• • Target

    15d198e1f1f09515d23cc7fd9dc23318_JaffaCakes118

  • Size

    125KB

  • MD5

    15d198e1f1f09515d23cc7fd9dc23318

  • SHA1

    0f6576a7f3b3762cd1bbb8d3248ae7be127f0b77

  • SHA256

    9f717dadeab1cfe106fc302c2259fbce1d78fc3e59bb5be588880d5c5f1be978

  • SHA512

    07aa51847f53757b6d89675d43b8903c4cdf93e343d7f830b286fb0239519c5717049333d9f97e546f453fc7c9d1c929924525dc79cc178a7aec74186159701a

  • SSDEEP

    1536:kHnb/2i3XNJ8itPxJB0+ey2/3nQng46PqyZXlfQEF2fqFUTEXa2A/6npjEmow5r2:gb2eNHJB+3v46Pn44Xy6namoyCP03R0

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2