Extracted

• • Target

    b1e074281a4660d8588a58f17bfc7ce5_JaffaCakes118

  • Size

    127KB

  • MD5

    b1e074281a4660d8588a58f17bfc7ce5

  • SHA1

    b89a30a0a0f4cb913e6c5bfa72e0278d74679429

  • SHA256

    b56d81b671c48645e12537461baf3d296f7c0becbc3e75ccdc59a720c1b879d2

  • SHA512

    c449342f2b2924002be69315ee025c7a9d81c1d09e54d9dfe2d413fd93eeaa9e24ee564ec1ec735e087861d1ecc7a36e7a2dc36fda6905f70c91bf4153d347c2

  • SSDEEP

    3072:cBQNkgCB/aXcRzn1Ym4XUNjJmi9NGTE0+:RNqB/aK1MkNjh94A9

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2