Extracted

• • Target

    041f807f3c84478dd09fe649d3eac3d2_JaffaCakes118

  • Size

    2.6MB

  • MD5

    041f807f3c84478dd09fe649d3eac3d2

  • SHA1

    b35dd799171bdcda521ab179f041ace74a5295e1

  • SHA256

    8ebab1c39b4ecb6e166a0728c44ae01626f249d0fd65206c4836feded498d48d

  • SHA512

    43bb6e0ca750769301caa1e4925d32fd24000b4c8812e1b972a1c38e4972a0f1c89f1881a011f65ba8b6754eacb618264d85acd97a9b7cccc8a825c41aeea658

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlHnnnnnnnnnnnnnnnnnnnnnnw:86SIROiFJiwp0xlrlQ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2