Extracted

• • Target

    a070f4a6ac8e3d25297d8399ee01cc04_JaffaCakes118

  • Size

    2.6MB

  • MD5

    a070f4a6ac8e3d25297d8399ee01cc04

  • SHA1

    2b33b3fac21e6707e714a5ac3db176522b7faa38

  • SHA256

    ff99a53c83c218f2fbb8cf585619b4b24341221aa0197bfbb746014cf5341a35

  • SHA512

    82d4417dff5924630dbbca687d41dd7e9c5880ed4b69d586a607416192d02fbfb2f4de67973c1fdf4eedd7aa3f39caed88dce970007269ed8f17a2bb6d50a298

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlM:86SIROiFJiwp0xlrlM

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2