Extracted

• • Target

    52cf09c7c506f5f6ee08b9f6b0299a16_JaffaCakes118

  • Size

    2.2MB

  • MD5

    52cf09c7c506f5f6ee08b9f6b0299a16

  • SHA1

    76f5e0e4a2f2798316cc92217032b2c994637444

  • SHA256

    14ccc91dea09c01566d93fc627bab13eeeeaede391ca68547cac07b2417ebf77

  • SHA512

    eae2dc3fb79a6052a9627aea77433f66a33b771ccf94abc82246c179217edc1cd5c1212727e41bb3c5f40f1d71d798b7cfb36e3be23c601cc940e5626a23c4c4

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwJ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2