Extracted

• • Target

    JaffaCakes118_0c09334a5f039f70d9b6ea431443d577

  • Size

    161KB

  • MD5

    0c09334a5f039f70d9b6ea431443d577

  • SHA1

    4051394edc4f196de54f8cbbc961dc1fe36353a7

  • SHA256

    501202cdf82a0b704458d0b9eb5894679f41d2d2b4a8cf2976fc302e6f36b5b4

  • SHA512

    e665813f05a4b36b62ed0d6ee1e1665d235fc98e9892f9af626798046359bbca3f3674504e9f04f4326707b98a26b843c52019fa6e0aa5177ea59c7a5c952bff

  • SSDEEP

    3072:LVNzN/bF9sk/khaQKvB0lSnpwNlakId+nGBdbMM:LVNzNZywrxp0lSnWzFwdbH

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2