Extracted

• • Target

    b8025d5188e662c433d36aacd3de1213_JaffaCakes118

  • Size

    144KB

  • MD5

    b8025d5188e662c433d36aacd3de1213

  • SHA1

    448723f062b305aacff78d1b4b188b6e8619ec1b

  • SHA256

    e7a34e9b72e7cf1812c9da4fbf5063244cb90750aa2d5498a12789038e7bbae0

  • SHA512

    ef8bb4f14dc16a15af60585983e4b9b538128c399be6f9b521f2f3a4fa1827c57d2b687cac5b00c16a9ae3b1398be7d69cdd358b4eda8c352cc93c8657a3d8ef

  • SSDEEP

    3072:0jlKZelTDGhDhjcZrTUdJuSGCbcuzvDbV5vQ+hzApaJ/zfMlR:4wel0hjCrQ6SqurDbg1aFzfSR

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2