Extracted

• • Target

    a3059f637ed0315b7332bc7b2ad9b0fa_JaffaCakes118

  • Size

    136KB

  • MD5

    a3059f637ed0315b7332bc7b2ad9b0fa

  • SHA1

    27a476077e47c54a72f019148055a55f27b1f8ac

  • SHA256

    963a7ebfc1b9f6b1be0420e9dd28284b7b28e1c5cbcb592be3491ec0ff19e7be

  • SHA512

    aec2b5f25d79f2d849fbc48eee3e3ae3625a5e32f4be0d1d28a8c8f4b6d8ce4b9815dd7c7d1ee5c007fee22bac348730fe7d63fb02e44f6b1f9681d236bcb4e4

  • SSDEEP

    3072:x55c6sCBz7OzNPM6D41vPe8lUAwfX8m37BesoGXwgi:x3coHOxPM6D413flUAw/L8sJA

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2