Extracted

• • Target

    75e6477c3decbcf6ae684948eaf96af2_JaffaCakes118

  • Size

    2.2MB

  • MD5

    75e6477c3decbcf6ae684948eaf96af2

  • SHA1

    c7386e79ba4059462a3510e2ee1f76c53070fc3f

  • SHA256

    aa72bcf3a91303ad7b3c46fa379c2ff687cc4369f428602d6088d20523d57893

  • SHA512

    adf4cebd10b4946135280c998f8c18014003d956f7d4ad0bd98d6e6cf4e7770edfeeb900b0e49d53c6f569965bfea713e74c79b00ccdd61dbf0798f2167abc12

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwT

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2