Extracted

• • Target

    ba08c8fe7a9053fdb2ac0ff61aa689f4_JaffaCakes118

  • Size

    141KB

  • MD5

    ba08c8fe7a9053fdb2ac0ff61aa689f4

  • SHA1

    11af4884af83d02b80a621d39dd19a723cac311c

  • SHA256

    a4006634ac5a740ba63e087c23247d6a6c4bc8a28d045d27a783ec9e7b0f5782

  • SHA512

    94878c4c2c4c075e3c834d3054331e661472779aac400a604b47c62987ca9d14fb254a4613b413f1d483a04db1ccc79701b537a8fa0a78d7d3af4e8843b8a625

  • SSDEEP

    3072:ZVWiwV7YXuuxonxd/Z+ew+S7fuIBlXLbpHpldakpaJxwPx:zWiwVcVaxdx+ewN7ll7bFn1aCx

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2