Extracted

• • Target

    7b30a84d4fb6a1167da41faa91acee47_JaffaCakes118

  • Size

    2.2MB

  • MD5

    7b30a84d4fb6a1167da41faa91acee47

  • SHA1

    d9a1d2f7ed533179af063e8a148fc2656f5e363a

  • SHA256

    66314f1788b6ed95b9d319b18b7ce73fd88e950bbb4b21fbd4087554edcee1e0

  • SHA512

    2e6063f8381b63f9fab5394c402136b218161fa4824269702a26e168c343c197a3686e913de07e3f403ec8122559c09639d7f5fca9cca4602b3f971c775aa4f8

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwo

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2