Extracted

• • Target

    77d665a2cb777a5a546c59327c032904_JaffaCakes118

  • Size

    2.2MB

  • MD5

    77d665a2cb777a5a546c59327c032904

  • SHA1

    67f3109547f0373efa2fb909252509dc4b2fc288

  • SHA256

    35bd97398833e8f8b7135ebcbb50cb34e23c63a7dd4b05eb3ba38497723d4ee4

  • SHA512

    d9a2b7e7e8d30aa20fe19c78c43cbbb10943b906a5c29901c7b4ba3081e4d40cd23de61090866d68c3e826e7a49afe477c298fa4b84c0a71b24638d2d76eae6b

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWww3

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2