Extracted

• • Target

    7b1df1fa0f3903fd94b2d0e9f235f99d_JaffaCakes118

  • Size

    2.2MB

  • MD5

    7b1df1fa0f3903fd94b2d0e9f235f99d

  • SHA1

    e08b74927121334f8005791d46d637a0b892004f

  • SHA256

    1e778ccbc4b56e8420acd6a73be228f4ece341106b3abbcfc61e895ff789ff0e

  • SHA512

    2c7d4a1f7912710be40c4509010c4e935c9fe18dcc8590252ed90b0cdd2191bff78c74b49823017dcd019139f72beca7f637609284ab6efa571e067c7c75abfb

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWww9

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2