Extracted

• • Target

    de605a64deabb3e4bffffafe56627bfc_JaffaCakes118

  • Size

    139KB

  • MD5

    de605a64deabb3e4bffffafe56627bfc

  • SHA1

    e20b8df40bf33fef1be1a4dfc67bb06ff8b94d87

  • SHA256

    79ea24a3926803335a4f27ee05a682919efe1bdcdcc8538054636497c8be98e9

  • SHA512

    567599ad9aedeefb22fcacf25f4494285f2b5f54c1759341b030c56359ccaeded6741c7b7310ca625cd2c9f56724d0e05624f5e3e6c91326c0872e73954e09c2

  • SSDEEP

    3072:IYQpMGQqFsdTTxlEDe0MrsfL+i6spekmp0:IYQWqFWTnCT9j+i6sppmp0

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2