Extracted

• • Target

    7f51343ef11f9c7105b35af77c6e1a4d_JaffaCakes118

  • Size

    2.6MB

  • MD5

    7f51343ef11f9c7105b35af77c6e1a4d

  • SHA1

    39944d67d09d60c4ee9bbfd0aec872f75a6c4fe4

  • SHA256

    7c0b0e27910f4b6210dc0d8c8ec0516c1f4151394d6f6883b5455c8d935b7708

  • SHA512

    f67cfdf17143b8e841fa19521d64347e38abc1c0aeb52be9155bb53101fbc183d6871c51e3a83039ebf4ca9a38afa58c7d1924c52162b14b5259a6b63c853932

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlr:86SIROiFJiwp0xlrlr

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2