Extracted

• • Target

    521f438da355967a995fbcc2e074f039_JaffaCakes118

  • Size

    2.2MB

  • MD5

    521f438da355967a995fbcc2e074f039

  • SHA1

    2d6570db77e942d41b8304a31ab1bdc4db7f5231

  • SHA256

    f7e0f10b5aeb13f2dec84449da43d53583c0d2021c14b738be0fac0c22124060

  • SHA512

    31412d07b292b6c30d2740a7dcaf323dbc0c521701ffdf08588dc5907c420bd3ddb1aeb34dfbab5fbf01fd2270761c92fad5fb125f1b3657c5c096fe896d6213

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZZ:0UzeyQMS4DqodCnoe+iitjWwwt

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2