Extracted

• • Target

    051e07bac7dcb56f3c7e9e8f9051efb4_JaffaCakes118

  • Size

    2.6MB

  • MD5

    051e07bac7dcb56f3c7e9e8f9051efb4

  • SHA1

    8a178e4a1b4eccae9e9c49781f88037fd800fba9

  • SHA256

    646be4d4b8608512f1183da1d45090f120adfc880798e9c703c68f2f5eaf658e

  • SHA512

    3286fdd5617afaa39628b690caf8e2cbc150a1e034db62690099283cd5d7399b77c0b70e49fd7660edb3de69c72dc00aff982ced1e974d562ef7a3903f17c202

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlo:86SIROiFJiwp0xlrlo

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2