Extracted

• • Target

    f042c3d91cb5dfc15af65b34b8aabf83_JaffaCakes118

  • Size

    112KB

  • MD5

    f042c3d91cb5dfc15af65b34b8aabf83

  • SHA1

    9687da5e942c82321eedcdf829613d7a59164c45

  • SHA256

    e720cfc376f2fbfddd818bc907038a3a9246aedc08fc92a866b0fc4e9e186498

  • SHA512

    eb8c1475526b64b3fd75cf204ad8780ab7923b32adae7c75efe39d61c842e2878ed1488e6a97c9ee94e9cc2a816cec2df761614125fc7b991276bb2df6428cda

  • SSDEEP

    1536:F7XGnNa7IodZuIe8GugLa+AtTrcC42/ljWpwNklkLHT2jCgW9XQfNjU:FDGQHFsaV3ljD3HT2EYNo

  Score

  10^/10

  ponycollectioncredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2