Extracted

• • Target

    6f272e8666499cc64261eec6c1933257_JaffaCakes118

  • Size

    2.6MB

  • MD5

    6f272e8666499cc64261eec6c1933257

  • SHA1

    741af1f47ee8a0a5ec6a522d3dd7f4dd69c76cb0

  • SHA256

    6f25e4159b4d623d694b625b51438108fcac03228e35790bded8f6fe6e335bb1

  • SHA512

    759e62b99b2c301af6f04e40727ef768c14c9cf6b14f8e52974d5484e4e719561156081ad66c397a8dc5a9a0c2c7216ac42a8a33f051faafb63dbc425944c9e3

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlZ:86SIROiFJiwp0xlrlZ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2