Extracted

• • Target

    bc6bce6da0447ab1b3253ab40ce05376_JaffaCakes118

  • Size

    131KB

  • MD5

    bc6bce6da0447ab1b3253ab40ce05376

  • SHA1

    9ce6afafdb41f9e2eb4d887f2cb3cd6037599d88

  • SHA256

    b1fe722373e79f58457abc8670ccf4f4b99be8f221871809a0e2b1260a2f87d5

  • SHA512

    1f009f9155dceb2a022a342690546214091ef22f6df61921e76d961b1989607da3b5e9466f881a0af69948b07fdbaa35d1f427c53826df2a53dd6cffcc5e1e58

  • SSDEEP

    1536:211GVWJpHT6ikppp3BAaQXZYqGAQXWvUcGOFxndfBR/gp2kwvdM/G81j4cFP4RLa:A1GEzFkpj+YqlI/UxRBIfOMG8qcFP4A

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2