Extracted

• • Target

    8430e7cfdb0789dcba3fb73e889d3592_JaffaCakes118

  • Size

    161KB

  • MD5

    8430e7cfdb0789dcba3fb73e889d3592

  • SHA1

    9309f8baf51c9430a40d77df1f2f685986ac2c05

  • SHA256

    cf673d74f3a0756288cf3499e6d6ef4240eef280d757719c98ee5ff5407a5fc1

  • SHA512

    4e7bd3bd767de33ad2dd152ee9dbd88a0eb1c4b63881599f35b01b46708a90671bfb7c884f891e536f68bb8cb8ffd40a9db0272869aa9861aad6e8b7abdc1a68

  • SSDEEP

    1536:0zMRZTK5f8KnULGsv0/wyJ0yqeEtjv3K97E:5ZK5fDnULjKJV06K

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2