Extracted

• • Target

    2a3a251dc7d127e6bebd5a7559bf7bf1_JaffaCakes118

  • Size

    2.2MB

  • MD5

    2a3a251dc7d127e6bebd5a7559bf7bf1

  • SHA1

    1cfd5dfd5c12bc20bef5f0deed27d9135e6d3258

  • SHA256

    cc51df8e1c900b5bbd3e46769a152bad6c225537f1bbf64beb1d4963392f3652

  • SHA512

    45d32fe35e1ee3fa4c5c002789647188b22ccc00803ea708f3684035218a09d1833da06a0f919d73240c3bfef04141c3228d70e17e1ebdf1003e43c2a4e965bd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWww5

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2