Extracted

• • Target

    JaffaCakes118_47791d57ba11b77aa458580920054491

  • Size

    153KB

  • MD5

    47791d57ba11b77aa458580920054491

  • SHA1

    c84e40cc543f117123b4218f8a4b5512304b2f6d

  • SHA256

    6b75166b6f8a120f9733d3b44814dbe292b7428ab99c607b0680a2d9f7e6956b

  • SHA512

    6af04945f91b9c9360564c97188749c255dfdb0c49b472266d2188f50bf9e3fb334f57607a309a1aa644dccdec31463d2250af57eb6aa4bde47691a3af2eb73b

  • SSDEEP

    3072:tDti6Gi1Xyr3VvYCrvX9ahRSwONpoeXakh6y5XolHe23bqg9p0t:tDti6Z1CrBjaewONmeNzt

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2