Extracted

• • Target

    a286c39065c3ec14f7e41dc0340f4b4c_JaffaCakes118

  • Size

    2.6MB

  • MD5

    a286c39065c3ec14f7e41dc0340f4b4c

  • SHA1

    1fac85867fefad842a151c6f6cc770e9a9eb7a3d

  • SHA256

    9d07d954ff9ee40448332f67047e736c46b5fe411e075d41e6cfda93faf8621b

  • SHA512

    1b5a49a3547f79b6cc931d0c85aa20febc53b59d6e1041fbd6e50aabd40a3e4d86671cae31ddee75fa694c89cc55d243c2103c0681ac7d7cc10b6ecef8541c10

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrle:86SIROiFJiwp0xlrle

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2