Extracted

• • Target

    a6d320fbf8b7bcbf0c57b724eb0e1011_JaffaCakes118

  • Size

    2.6MB

  • MD5

    a6d320fbf8b7bcbf0c57b724eb0e1011

  • SHA1

    9a72623c8a91e324f5e21193701616ce3dd43a7b

  • SHA256

    23bbecb173a0a7021ed5dd533a432efc21378a4c47eff0269b1a2ac91c96a73e

  • SHA512

    e867b5588db501d9370e470d98cfa9fb8a5965c3bd4db13d29e70129f66f18f08701320b58471611c47d60b6810f00d3316b0ceaa76d492fab924bf53dd3c551

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrla:86SIROiFJiwp0xlrla

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2