Extracted

• • Target

    6135e8bfe2cb21b47da662936aaaf7e9_JaffaCakes118

  • Size

    2.2MB

  • MD5

    6135e8bfe2cb21b47da662936aaaf7e9

  • SHA1

    0a1ff102b0215a7c836efab062074c6c5119503c

  • SHA256

    aa95c64f909e4455100ecd9494bfed2bfc7bd262f3c31a1173f21c1a0a125ed9

  • SHA512

    cd586171b5390be816127a806ea0e6bc4fed9107bbfe667868fc6ffba0b8c5c21ac2b44ce9d454c979d97035bd9fce6fadcf99dd7e9fdb19601b0bb3cb32aa66

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwo

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2