Extracted

• • Target

    JaffaCakes118_6696ed85fef753c0243d5ba8cbd76eb3

  • Size

    102KB

  • MD5

    6696ed85fef753c0243d5ba8cbd76eb3

  • SHA1

    be4b7623e2da721b8023c2b34ba0a86286960ed8

  • SHA256

    7e97e007834215845d31883ce68e43ac791fa0b691ea846dcacc9cdf8abba12d

  • SHA512

    23843aecf76f92fbdcc72edb49e56d520f8361ac810d1d8560d8ff71efdffb3a59f484289ecc961622e47812989367f95a94f0271b4a7e0d5d82ff0a73d8fb1e

  • SSDEEP

    1536:TPwMMXFsGoGQo2cs1Tq2tPt9Me7mp8KIboMvWqaTL10uY6mZwdnN2kWz/gxtqq+H:mKGcVu0YSr3+FTGn6moN2JMwq+Ay+Q

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2