Extracted

• • Target

    53b833c061a75f9bc9229d6065e4cf9a_JaffaCakes118

  • Size

    2.2MB

  • MD5

    53b833c061a75f9bc9229d6065e4cf9a

  • SHA1

    75b537204c2cae3a6351d8f6bc36ff2c5944ad48

  • SHA256

    19bf8a4172d0828874dfcffcbec489822342211d058d1161ce6b25366252a4d0

  • SHA512

    22299741a940862793aef26c96c0068334a1c185c6763bb028a167b9d32ca0f147fbfdd5cbfc5e0be764de44b410886da9c85f3285d8dc66162c8c65a68fa174

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwp

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2