Extracted

• • Target

    6bbd05b1405e17e9eade873efc9efdbe_JaffaCakes118

  • Size

    2.6MB

  • MD5

    6bbd05b1405e17e9eade873efc9efdbe

  • SHA1

    ba21b186744e4fb7b7a2dc7804d1f91d48181a22

  • SHA256

    b24a39285fa9c5bb8efb507fea064c05e05ab994e6607fe55a085ccbb0619c69

  • SHA512

    5420f76ffa9b231f408f4e816710dc80631ea8223846e0a97e121d1d84af2787686d86e81ab215f98ecc4ecb4c47b69512de4037e0f66c5a40ab7f443c8fcd04

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl9:86SIROiFJiwp0xlrl9

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2