Extracted

• • Target

    2282af304e393c1cdb4ba7b4a8264384_JaffaCakes118

  • Size

    2.2MB

  • MD5

    2282af304e393c1cdb4ba7b4a8264384

  • SHA1

    394b8229bd58daae5585e07012a44608e44a34f8

  • SHA256

    0006c2556e8255f7040054764f605daf042641577555d33601924a4c0174a28a

  • SHA512

    9bf0539c6184a00d80626d084387b0e289091d9a4a61b90397d545d830e71ba365dc1a25b4b9f8067b0801470c63b6e2f4e8617ec504dadc038be8c1c974c99e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWwwZ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2