Extracted

• • Target

    646457daf0dcff62087dea312e858942_JaffaCakes118

  • Size

    2.6MB

  • MD5

    646457daf0dcff62087dea312e858942

  • SHA1

    2462dba1e6dc18c79c190131ef0373595afdb6ca

  • SHA256

    f8d18a8b859c7f0ce3c6e6276d560fe95f2c4374cc7be20afcf5f493de3260cc

  • SHA512

    3c481b02f5ff43ec3b6f54c4b3d26e63930c4bbb2bd9c32d376f1f14b97f62b6c6807f740e3d096b490fc221b77fc74f369c9877b62c1272e06b5720ad0678cc

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlO:86SIROiFJiwp0xlrlO

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2