Extracted

• • Target

    49be274f8b285ce0a8237fb4d21942ab_JaffaCakes118

  • Size

    133KB

  • MD5

    49be274f8b285ce0a8237fb4d21942ab

  • SHA1

    ebcded05fa16412ddbd3c0051e666dc4449fcfe0

  • SHA256

    1331470a02859b85ca769552248a004c84df0b611b6bd06bc0b0a9e50c5aa13b

  • SHA512

    dae5fa25ebde08b8c4e7aa6f54a7ac8380c688ffb2da0fb6492c4530caca5f3a2368377046740b5d4d6ce883dfeb14d8c5ab78cfcc36934a910f8d6e783a0f2d

  • SSDEEP

    3072:QyW4R/iRVS0gDDuNPqlN8pziLSq2KI+SCRzURIr9Acy6ZVL4uQRgI+H:Q6R/W63uMYN2rZjSQIRIr911ZVYZ+H

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2