Extracted

• • Target

    62e98d9440f46aee1ae9532624d04b12_JaffaCakes118

  • Size

    2.2MB

  • MD5

    62e98d9440f46aee1ae9532624d04b12

  • SHA1

    1af3208f278f8614c468ecd7f40e58b46b5a372e

  • SHA256

    d448af0c82402bfa5726759aada82ce7f8831790daad2a72d687e38170cbc9e0

  • SHA512

    7eafb25ed81a39762c4c11bbe28026b7c6b68953684d660e2dda40c6b502e8b4701067362eed55e6592eb5468a699f11934f9915201a582859f6dd4c66ba3b83

  • SSDEEP

    49152:0UzeyQMS4DqodCnoe+iitjWwwcPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPK:02emwF

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2