Extracted

• • Target

    562b3d15476b2ae1dd638bbcf99e455d_JaffaCakes118

  • Size

    2.2MB

  • MD5

    562b3d15476b2ae1dd638bbcf99e455d

  • SHA1

    01e32a3fc1023bec3d391cb6ff4371d5ab542010

  • SHA256

    76bfe692507354a9b1ca5a8c70bd4701ed7f5d417bfecccac9a258bafae3f10d

  • SHA512

    50c236a5e4ddb431b56498974c9b880e12eaf2ad2dc51436054fd74a465e72b5801683b0fb49e7bd6ae143b24d25ab5332d7806523d75179390f4d123b6b9a01

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwZ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2