Extracted

• • Target

    5397151c14c7be3916e28d00b41558ff_JaffaCakes118

  • Size

    2.6MB

  • MD5

    5397151c14c7be3916e28d00b41558ff

  • SHA1

    55be4d0d7aa38653400ead7d26289f8d02b682d2

  • SHA256

    dcb7cb835f198f91112189b8f7db27a169ac6d1db41186ef39ec88fc997c3523

  • SHA512

    39655188390dc5ae5b3955aaa479ebdf2f19136141612045dc5a9abb0c1b3505e9d66c751c88a1f7c28a4b395507d9fe6cf461c9841a0cb9e801d83dd4c404c9

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlb:86SIROiFJiwp0xlrlb

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2