Extracted

• • Target

    JaffaCakes118_2650875cf15182fce4946761e011ef3b

  • Size

    145KB

  • MD5

    2650875cf15182fce4946761e011ef3b

  • SHA1

    759ce408420b5824df575d130f39b3dbc3e6c942

  • SHA256

    565c7fba14895af4529a57292595d072df3b49f7d8cae5a88a58f8b56ffe5dd3

  • SHA512

    afab5177cc1caa67389ded137d263c00ee4419170c68dcd799820aab3528f933e27cc994a66050f8dc9b4a4195e9e93467d50fa23fd63484da1fc09ce5895d4f

  • SSDEEP

    3072:J9Pk0IyMINRFnyDgaoui1d4uyIwfr+3ZpohE/ki8DPy96sgfovR9:HLb2Yui1dl34WGyIfovR

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2