Extracted

• • Target

    5b7893f6a56b4b67582f8b4688248610JaffaCakes118

  • Size

    2.2MB

  • MD5

    5b7893f6a56b4b67582f8b4688248610

  • SHA1

    ebdae86585414cdb42bb20114cb35254bc867545

  • SHA256

    861c76a480250d234051c5e49e73cfc7f4638c81a4654a7eccfcf756c61b9d99

  • SHA512

    b86b5345b7abe3ebc6a9894dc67b66a83a17c251f3cdff349b4365af1ea781b608317f8a3244dc815227d8503af09f8400d41fd6a67f7f8e0750496cfbe4e3aa

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWww7

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2