Extracted

• • Target

    7c62dea5339709839bc6053f92650a95_JaffaCakes118

  • Size

    2.2MB

  • MD5

    7c62dea5339709839bc6053f92650a95

  • SHA1

    946f4c5d215b305f7a361d07f6822ea6043f819d

  • SHA256

    aafcf0332be46d19726e762ea26ca1ff7d62653df4ef7f9910db4287c38fd28a

  • SHA512

    3187c6f8306d87c2cfa532c2c2253fba8f6decd291f11b1f77be755902264e99f64d576bcc48824935ae57e3ab357ac1fe8121efe65db33a59da5725dda3f46d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWwwu

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2