Extracted

• • Target

    04d7acef871d0088d732f8ad3cdcdff8_JaffaCakes118

  • Size

    2.2MB

  • MD5

    04d7acef871d0088d732f8ad3cdcdff8

  • SHA1

    9a7be69a5077d08661c33b7c747f335dd1451df9

  • SHA256

    936e77203169953a14b2b19d09edd822cb14a3cbd2cb520d3f41f4eba02937a0

  • SHA512

    1839f74fffa49b700b56862ff816f60c8564d910a183cd3f33384267b8d63ee9fc70e56b141286ae33ca96a4fad3eacb30b6abea5a4131b84bd974875389b115

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwl

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2