Extracted

• • Target

    38804f940229604c50690a401071df19_JaffaCakes118

  • Size

    142KB

  • MD5

    38804f940229604c50690a401071df19

  • SHA1

    5c658b91914bfc415ade454b95130047ceeb3a73

  • SHA256

    bb5d9b53b6a4ec7d6579a2b4e4e28eeb1db43ead0d175799657f526ad517e437

  • SHA512

    057996bca2f3f2bbcab588f2128489c113b15330c85e2a225dabcc1c3b8ceaf855d8e15b3c37ef2ab3906f3cc773f8ea74fe8e268f9c898b4059e26d0d5083e0

  • SSDEEP

    3072:79pULniSi0rj35gQ2mPDjVgsloRe5i8pz6:jUtvJimPR1

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2