Extracted

• • Target

    JaffaCakes118_4d351d24dfbb10815fed524d560b539e

  • Size

    145KB

  • MD5

    4d351d24dfbb10815fed524d560b539e

  • SHA1

    fd0157aa0b96059ac2622940a40fa709f6440a40

  • SHA256

    b549e218d6397e0dc3cbc2446998c4bab06708ab8615d096952272cfe81a316a

  • SHA512

    7d47fc7901bbe7f97ff1ce0b84d79f9b3d14916b7e376a5c8cd5300b9636852816393bb4d1067cef8a4228ede77a95c811e10788155313eb9ce7e1500ad552c7

  • SSDEEP

    3072:J9PklI0Q7zYSK4EX4mlHD4DEm5j3woHXklQFuIbxgfovR9:H6M8QMlHDKH3FupfovR

  Score

  10^/10

  ponydiscoveryratspywarestealercollectioncredential_access

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2