Extracted

• • Target

    7b2f08dcba2d45649e54cca820d442d1_JaffaCakes118

  • Size

    2.6MB

  • MD5

    7b2f08dcba2d45649e54cca820d442d1

  • SHA1

    65dcdca963570d11d6d9c99f2cddd356abb69a62

  • SHA256

    46255b91121c1115749f8464d8f6758ff68fcca7fe0b0d2170e86e3032d2d5db

  • SHA512

    0011cbdd05835f30ac4f65d5032583af6ee0a59e341ecc6611648ee80b50f2aedbcf374b16cbf5e22275483108323c5d9280d7e8bd1a59aaef0ec5de257e9e3c

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlF:86SIROiFJiwp0xlrlF

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2