Extracted

• • Target

    JaffaCakes118_031908891bebcb85db90d47b9405ea50

  • Size

    144KB

  • MD5

    031908891bebcb85db90d47b9405ea50

  • SHA1

    e5dc3fcabcc0de610481e2cdf591d13e3c3615e8

  • SHA256

    5b959114fd0c6396f168752b8782c1d53d9e6f7504b9b6ebd31dda7f0f44d517

  • SHA512

    e107ac4ff772b80c2de4d3f8e3a53561c8608ba6cdcd81a0b012d83e19d3c3807b7e41d1b03b27f598f943b2f1d03b9847e7733537990de17242af658dc31318

  • SSDEEP

    3072:tlCZwX7wRUCfra36ZbYNgLV3XJBbKuMHiJgpaJDK0rvox2qUQ:fCZwX0ra3UbYuFPbUJavrE

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2