Extracted

• • Target

    55d795def183f21a5f58e5f456a1e509_JaffaCakes118

  • Size

    2.6MB

  • MD5

    55d795def183f21a5f58e5f456a1e509

  • SHA1

    bad6e0ef8fdaaf6a071186b0cad5e8a4d29ae5a9

  • SHA256

    659ae6756fb3b3bdaa3df66fd85bc3a24d6f5d7a291503d5b9f797c79643bb4c

  • SHA512

    c617dbc71d3f30c69d4cba6e2e7cddf7a13b654be921219f7a3308d3e3e8d330c90ae92384b3ecf27b620dcbad0aec0bc5ba11a445f71b5155655e35905ed527

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlt:86SIROiFJiwp0xlrlt

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2