Extracted

• • Target
    58527e992d70359ed508613a7f5bffd5_JaffaCakes118
  • Size 144KB
  • SHA256 5196ca266f641472c86f67815d189ab55f6c151b29d90d9be79e890d49766a99
  • MD5 58527e992d70359ed508613a7f5bffd5
  • SHA1 67cbf057f872a8f9454d0f8abfee41fb1bfe0c8a
  • SHA512 caf61a64ac5ed47ced3480cd8b52f65671feb0f5e2998f3aa4b1ff3fb30d52a27d4dc891a625020301ba85dadb54bf748f089a3c7c602f0f5e9760eb36c93c8c
  • SSDEEP 3072:oDZaZeFbZHbSnCZYoB1rLAxgutQb0HdUyY6CpaJFsZLoYHY:wgejSn8YoLLVrbwzuaj2rH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2