Extracted

• • Target

    JaffaCakes118_91d03d21ebb9ac8009f8fa6bf70dc8c5

  • Size

    145KB

  • MD5

    91d03d21ebb9ac8009f8fa6bf70dc8c5

  • SHA1

    620a4806399861b9f8b0fd8d92c6dc767ea9594e

  • SHA256

    d43f855cbfcede4829d8d3bc3be57af49e9db28dcaa9ebf1bef8120bc8105716

  • SHA512

    e8aa078530b799a82ece64982c991f864eaa64812750a54f2a32427b4f1f87a46ddb382ecaf6368bbddd541173aa70e7e9185cc2e6b0471266aa27d80a18069d

  • SSDEEP

    3072:J9PkjI0Q7zYSK4EX4mlHD4DEm5j3woHXklQFuIbxgfovR9:HIM8QMlHDKH3FupfovR

  Score

  10^/10

  ponycollectioncredential_accessdiscoveryratspywarestealer

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2