Extracted

• • Target

    0675943ba90e4b700dfb095f1c7dee58_JaffaCakes118

  • Size

    2.2MB

  • MD5

    0675943ba90e4b700dfb095f1c7dee58

  • SHA1

    8b865067cf5532d80edc3ab0be6c251d8ed13a66

  • SHA256

    a37bcdef4f1338639d07f79229589e92cb98bbc5491b679803cb1c7664896297

  • SHA512

    73058ac798a4c859788a13d576d2d93594ecfcb18dbc767d42488291e828e705a41715bd21e1650958c7dee4f3487b8ea4fded49ba610ad899bf773c2d906c5a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZG:0UzeyQMS4DqodCnoe+iitjWwwa

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2