Extracted

• • Target

    570f95c7a34e9c11f4227bfe194b233f_JaffaCakes118

  • Size

    2.2MB

  • MD5

    570f95c7a34e9c11f4227bfe194b233f

  • SHA1

    1108ae050dee2f263c1b54dc2f1f8fc8f93285ab

  • SHA256

    76e86389d4a185a712524bad2098581383f6b909fdd922d443d28dcd9751d432

  • SHA512

    8661a46b5dc085c3171a39ba871048b4855406f5f74f279edcccbecfc8e4cd543174676d0e97aca084e7a91cbd500eb154975e56ff336737a5fd1397a7f9e13e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwA

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2