Extracted

• • Target

    051cb7a9e12667f2e27d8ba7026d2e32_JaffaCakes118

  • Size

    2.2MB

  • MD5

    051cb7a9e12667f2e27d8ba7026d2e32

  • SHA1

    a37fce08834a493ff4120fb58f22420c6d042993

  • SHA256

    5239ab5be83ebc871521c03771d912e5f9cb96552cc9b38b27e97bbfb6c45b2e

  • SHA512

    a9f09a33a559031f43aef8bd974ed396c175f67273c5211b71fe607ad5dbc6b237cb40d596f63a363ee7a992178ef07fb8a38a3331fc4d8d3dc82c944c533b87

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwM

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2