Extracted

• • Target

    593f219ce53ecb7e9278950ae843ccf6_JaffaCakes118

  • Size

    2.2MB

  • MD5

    593f219ce53ecb7e9278950ae843ccf6

  • SHA1

    136ed1f1ee5c46592cac8a01b8927d992737d92a

  • SHA256

    ce0a85cbc7f37ce7231da1f3ef1675863a5567f19820e07bfdde0b17f2d9f9af

  • SHA512

    f2fb6d9a96e986e2e9a892acc2e94a24dc8bef1d67965582f51c48e9ea1423d1a718393209f830868a91e21efb6de57062179b7d8784ff122fadd299fce8a4fd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwJ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2