Extracted

• • Target

    61dbf88ca276eff5bdea32fa333d7cc7JaffaCakes118

  • Size

    2.6MB

  • MD5

    61dbf88ca276eff5bdea32fa333d7cc7

  • SHA1

    64119a8bdc61888ccf9763486aa98773720f566b

  • SHA256

    98f2ce9f36e8f90c0ecf0c0f3ee01f78c3e88de275864f9fc036dce2437cbb5d

  • SHA512

    c4b043dcde04e209bcc578eee980e818776ccbefec2d852ff51de42e9dbc7758e37593cfe3d46d7a6ddee1b0fe85fc93728c0375251bfc8de35e5b4ff312aa91

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlk:86SIROiFJiwp0xlrlk

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2