Extracted

• • Target

    5db40bee3d1a01e8a00d8ade6a6fb330_JaffaCakes118

  • Size

    2.6MB

  • MD5

    5db40bee3d1a01e8a00d8ade6a6fb330

  • SHA1

    848bfeb29661e9cff7240e1a6d2d52b319307c90

  • SHA256

    959cc1f2c8fb8860af782c509fd19d1018e08b1f4d7efad44009b7109f4923d3

  • SHA512

    f11b8af4868c5ba7c59b90eaa0724b4b3ac7d454d35644a381dd7d70a23683b185b8196c07bf408198561489005d755a28a954a3873c8e1f5aade7aba229eccf

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlK:86SIROiFJiwp0xlrlK

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2