Extracted

• • Target

    7421ca9ed2b11b19b25d84ae52e629c1_JaffaCakes118

  • Size

    2.2MB

  • MD5

    7421ca9ed2b11b19b25d84ae52e629c1

  • SHA1

    dd1b964e80a3c6e8e167d37e68df94b137c33a3b

  • SHA256

    18d4f3dc45194182c2079cc1837e48de8290281fb3f00d039a7790120261c618

  • SHA512

    9a8616be4f4cee93d1a55b1d21ae46c64529c4a72fbeedf81739943e245ffa7483a14ea45bea8f8cb7f998d6eed61b9add73dcb5434223ed0bfb5e108157b5fd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwN

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2