Extracted

• • Target

    4ed7b9921d1939ad2cb0c01111125f52_JaffaCakes118

  • Size

    2.2MB

  • MD5

    4ed7b9921d1939ad2cb0c01111125f52

  • SHA1

    7b7687b257f03ca493afffb8c7886c64f9fdc6d8

  • SHA256

    3682be0a0666f30ef486c1705db234a9bbbf2dbf8f74b6a8a95bba72fb704908

  • SHA512

    fbfa6c79b33f4adc94a11f7bdd7dcf22fdefe77103e75ca351146bd35572e3abdb1346519df2b55979733629680b8c52b68b968b925f57742ca444e4cf84228d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwt

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2