Extracted

• • Target

    5c65cb6dedc50e5ec0e10e9818cde351JaffaCakes118

  • Size

    2.2MB

  • MD5

    5c65cb6dedc50e5ec0e10e9818cde351

  • SHA1

    78fe3276595bf91be88a78b91337b95c3cf25719

  • SHA256

    10d0ae48d5f6955867b6d256f63dc91db70b597a4596779f8fc3bf366bffb945

  • SHA512

    f6547da417a25f11024e605734d00fdcc8e8ea2d6ec0c4b8a3f5ce2bd2be42af80ca125eec6f78e55dff291b309980646d2f61c6bafa9c36bd97d213e9726e75

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ4:0UzeyQMS4DqodCnoe+iitjWwws

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2