Extracted

• • Target

    815cf9b6e4128d80814d59746e49400f_JaffaCakes118

  • Size

    2.6MB

  • MD5

    815cf9b6e4128d80814d59746e49400f

  • SHA1

    3aa196ecc01d72ebdb78aef5ad2de177a51a46e1

  • SHA256

    353fc5aaf59a76aaab79ce6c7221b0e673b3cc08d4a75f6d3fd320906053412e

  • SHA512

    adbe904beb027a8c762b3cd80d12dabdc4bd3babf76fc208d4ee2d17bc2136877a0895e33ac8c6e6a85be0ad88e18f9b984d92fceafe6b0a2ff34b74007b1610

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlL:86SIROiFJiwp0xlrlL

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2