Extracted

• • Target

    df34a8225ea6cbb48e2ae05ee1a3c445_JaffaCakes118

  • Size

    147KB

  • MD5

    df34a8225ea6cbb48e2ae05ee1a3c445

  • SHA1

    7988613315f2832cf56023176ffaf7bad3db85a4

  • SHA256

    faa338a618c1c1cd400df223eb0e340723e7c65a2c7c36864135407ef937b032

  • SHA512

    3ec8d0804d5558a896cc3f8e9fc4d1e14ac0662374f2053ee202c4f023f256374cb5f27abbe4b4200f1cf74ceaa2d07ccb5e5dfaf6fe9b434089aa6b5905ec0b

  • SSDEEP

    3072:z5Rfr1ZZpFhVpnZhSGZIliR+z4tQP16mo4mLMAKNDl:z5tr5BVFZdIER+ngMAKND

  Score

  10^/10

  ponydiscoveryratspywarestealercollectioncredential_access

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2