Extracted

• • Target

    JaffaCakes118_079429a05ce57875cca8c38720d31c2e

  • Size

    129KB

  • MD5

    079429a05ce57875cca8c38720d31c2e

  • SHA1

    5c778e757f9ca7a4634f979f7de69bd8ee8d8a1a

  • SHA256

    5b7d08c2c13f94fea3ff8f017bc1277ae16080885e4fe9a39f9c554147f46b23

  • SHA512

    5fb4066d709aacc1e79257aeff42a21b2698ca087a05467c779cf693cb8dcd66ac1035196c7078ffc4b57989dfd90bc85659cd012b9accd3c794b748f16095db

  • SSDEEP

    1536:UUBiFqtXmPmgC9Xc7LPY3pf+gij01r7TNwm7QQHfADHkTZvMS3J/HjYWtLm1DK:UOn16mg2X6gR+B43TNwIWTM/DzqD

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2